CVE-2026-88048 tesseract-ocr CVE debrief

Who should care

Defenders responsible for Tesseract installations, especially in environments where untrusted .traineddata files may be processed, should assess the potential for information disclosure or controlled corruption and prioritize verifying the integrity of Tesseract installations.

Why it matters

Defenders should prioritize verifying the integrity of Tesseract installations, especially in environments where untrusted .traineddata files may be processed, due to the potential for information disclosure or controlled corruption.

• Potential for information disclosure
• Potential for controlled corruption
• Heap corruption and crashes possible

Technical summary

The vulnerability is caused by improper validation of deserialized layer scalars in the FullyConnected::DeSerialize function, allowing for a heap out-of-bounds write and read on the default LSTM engine. This issue can lead to heap corruption, crashes, information disclosure, or potentially controlled corruption. The vulnerability is present in version 5.5.3 and earlier of Tesseract, an open-source OCR engine. A crafted .traineddata NT_SOFTMAX layer with inconsistent dimensions can result in a heap out-of-bounds write and read, potentially leading to controlled corruption or information disclosure. Defenders should prioritize verifying the integrity of Tesseract installations, especially in environments where un

Defensive priority

Defenders should prioritize verifying the integrity of Tesseract installations, especially in environments where untrusted .traineddata files may be processed, and assess the potential for information disclosure or controlled corruption.

Recommended defensive actions

• Verify the integrity of Tesseract installations
• Assess the potential for information disclosure or controlled corruption
• Monitor for suspicious .traineddata files
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.6 and severity of HIGH. However, no fixed release is available as of this review, and the issue requires verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.