CVE-2026-88054

A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. A remote attacker could provide a specially crafted '.traineddata' model with a zero-length stack for certain internal layers. This would cause an empty-stack dereference during model loading, leading to a deterministic crash of the application. This vulnerability results in a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that Tesseract only processes .traineddata models from trusted sources. Avoid loading or using models from untrusted or unverified origins. Additionally, consider running applications that utilize Tesseract in a sandboxed environment to limit the potential impact of a crash.