CVE-2026-88049: Tesseract: Heap out-of-bounds write in LSTM::Forward via na_/gate-matrix dimension mismatch
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and NetworkIO::Randomize in src/lstm/networkio.cpp but left NetworkIO::WriteTimeStepPart and NetworkIO::AddTimeStepPart unchecked. In LSTM::Forward in src/lstm/lstm.cpp, source is sized from the independently deserialized na field while the WriteTimeStepPart count is ns, which comes from the CI gate WeightMatrix dim1() value. A crafted NTLSTM layer can make ns much larger than na, causing a heap out-of-bounds write during the first recognition step on the default LSTM engine and resulting in heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Tesseract 5.5.3 and earlier are exposed when they run recognition with a crafted NT_LSTM .traineddata layer. The affected path is the default LSTM engine, and the out-of-bounds write occurs during the first recognition step.
What does an attacker need to exploit it?
An attacker needs to supply or cause use of a malicious .traineddata file containing an NT_LSTM layer whose independently deserialized na_ value is smaller than the CI gate WeightMatrix dim1()-derived ns_ value. This dimension mismatch causes the write count to exceed the size of source_.
Are the earlier .traineddata bounds-checking changes sufficient protection?
No. Bounds checks were added to NetworkIO::CopyTimeStepGeneral and NetworkIO::Randomize, but NetworkIO::WriteTimeStepPart and NetworkIO::AddTimeStepPart remained unchecked, leaving this write path vulnerable.
Is a fixed release available?
No fixed release was available as of the review. The referenced commit provides relevant remediation information.