CVE-2026-88050

A flaw was found in Tesseract. It was discovered that the RecodedCharID::DeSerialize function accepts negative code values from a specially crafted .traineddata recoder component. This can lead to an out-of-bounds write when SetupDecoder attempts to index a zero-sized vector with a negative code. A local attacker providing a malicious .traineddata file could exploit this to reliably cause a wild-address crash or an allocation failure, resulting in a denial of service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid processing untrusted or unverified .traineddata files with the Tesseract OCR engine. If processing untrusted input is unavoidable, consider running the Tesseract application within a sandboxed environment to limit the potential impact of a denial of service.