CVE-2026-88052

A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. The UNICHARSET::load_via_fgets function incorrectly trusts a declared character count, which can lead to an out-of-bounds write in memory. A remote attacker could exploit this vulnerability by providing a specially crafted input, potentially causing heap corruption, a denial of service, or arbitrary code execution.

This vulnerability is rated as an Important severity flaw because an out-of-bounds heap write could allow an attacker to achieve arbitrary code execution in the context of the running process, rather than a crash alone. Within Red Hat Enterprise Linux environments, Tesseract is typically deployed as a standalone utility or linked library in automated data extraction pipelines. Exploitation is constrained by the prerequisite that an application or user must process malicious character set definitions or untrusted model files, preventing direct unauthenticated remote exploitation under default configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, avoid processing untrusted or malicious image and document files with Tesseract. If Tesseract is not essential for system operations, consider removing the tesseract package to eliminate the attack surface. If the tesseract package is removed, ensure that any dependent applications or services are not adversely affected.