Vulnerability Details CVE-2026-88048
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni_ and no_ against the weight-matrix dimensions. During FullyConnected::Forward, MatrixDotVector in src/lstm/weightmatrix.cpp writes w.dim1() results into temp_line, which is sized from no_, and reads w.dim2() minus one inputs from curr_input, which is sized from ni_. A crafted .traineddata NT_SOFTMAX layer can therefore use inconsistent dimensions to cause a heap out-of-bounds write and read on the default LSTM engine, resulting in heap corruption, a crash, information disclosure, or potentially controlled corruption. No fixed release is available as of this review.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 1.7%
CVSS Severity
CVSS v3 Score 7.1
References
Products affected by CVE-2026-88048
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:1.03
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:1.04
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:2.00
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:2.01
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:2.02
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:2.03
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:2.04
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:3.00
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:3.01
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:3.02.02
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:3.03
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:3.04
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:3.04.00
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:3.04.01
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:3.05.00
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:3.05.01
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:3.05.02
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:4.0.0
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:4.00.00
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:4.1.0
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:4.1.1
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:4.1.2
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:4.1.3
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.0.0
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.0.1
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.1.0
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.2.0
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.3.0
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.3.1
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.3.2
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.3.3
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.3.4
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.4.0
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.4.1
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.5.0
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.5.1
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.5.2
-
cpe:2.3:a:tesseract-ocr:tesseract_ocr:5.5.3