CVE-2026-88047

A flaw was found in Tesseract. This vulnerability, a stack buffer overflow, occurs when the OCR engine processes a specially crafted .traineddata file. An attacker can exploit this by providing a malformed input, leading to stack corruption, a denial of service (DoS), and potentially allowing for control-flow hijacking.

This vulnerability is rated as Important because successful exploitation can result in stack memory corruption and potential control-flow hijacking within the application context. In Red Hat Enterprise Linux environments, Tesseract is an optional OCR library and command-line utility that typically loads verified system-provided language models. Impact is largely confined to deployments where untrusted or external legacy trained data files are explicitly accepted and processed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid processing .traineddata files from untrusted or unknown sources. Additionally, consider running the Tesseract OCR engine in a sandboxed environment to limit the impact of potential exploitation.