CVE-2026-88049

A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. A remote attacker could exploit a heap out-of-bounds write vulnerability in the LSTM::Forward function by providing a specially crafted input. This could lead to heap corruption, application crashes, or potentially controlled memory corruption, which may result in arbitrary code execution or a denial of service.

This vulnerability is rated as Important severity because, although triggering it requires loading a manipulated language model file, successful exploitation can result in arbitrary code execution within the context of the executing user or application. In standard Red Hat deployments, Tesseract processes trusted data packages provided by the operating system, which limits exposure unless an environment permits user-supplied models. Systems that integrate the OCR engine into automated ingestion pipelines or services processing untrusted model assets face elevated exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid processing .traineddata files from untrusted or unverified sources with Tesseract. Restricting the application's input to only trusted .traineddata files can prevent exploitation of this vulnerability.