Stack buffer overflow via crafted .traineddata file

Published September 10, 2026 CVE-2026-88047

Tesseract can crash while loading a specially crafted OCR model file. On some builds, the flaw may also let an attacker run commands.

Severity
HighCVSS 4.0 · 8.6
Fix
Fixed in 5.5.4
Affected versions
5.5.3 or older
Weakness
CWE-121Stack-based Buffer Overflow
Exploit likelihood
0.13% in 30 daysEPSS, higher than 3% of known flaws
Affects
Tesseract
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: total
EU ID
EUVD-2026-75590ENISA vulnerability database

How it works

  • An attacker provides a deliberately malformed.traineddata file.
  • Tesseract loads it through its legacy engine and copies an oversized text value into a space that is too small.
  • That can corrupt memory and crash OCR processing.
  • On some builds, the corruption may redirect the program to attacker-chosen commands.

What to do

Compare the Tesseract version used by your application with the advisory. Versions 5.5.3 and earlier are affected; Apple libc++ C++20 builds are described as incidentally protected.

Update Tesseract to version 5.5.4. Until then, use traineddata files only from trusted sources and review the Tesseract security advisory.

Technical details

CVE-2026-88047 affects Tesseract's legacy engine while reading the NORMPROTO section of a.traineddata file. A token longer than the internal space can corrupt the stack, causing a crash or potentially enabling control-flow hijacking. The upstream fix limits the read and rejects overlong entries in version 5.5.4.

Severity breakdown

  • Attack vector Local Needs local access to the machine
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure High Sensitive data can be exposed with serious impact
  • Vulnerable system: Data changes High Protected data can be changed with serious impact
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source