CVE-2026-88052: Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization

Q: Which Tesseract versions should be treated as affected?

Version 5.5.3 and earlier are affected. No fixed release was available as of the review date.

Q: Does switching OCR engines avoid the issue?

No. The vulnerable initialization path is present in both the default LSTM engine and the legacy engine.

Published Sep 10, 2026

Updated

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::loadviafgets in src/ccutil/unicharset.cpp trusts the declared unichar count as a loop bound and uses id as an unchecked index into the unichars vector. unicharinsertbackwardscompatible can leave the vector unchanged for an empty, duplicate, or already-encodable representation, causing id to become larger than unichars.size(). Subsequent set calls and the write to unichars[id].properties.enabled then write UNICHARPROPERTIES beyond the vector during initialization in both the default LSTM and legacy engines, causing heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.

Affected Software

1 affected component

Tesseract Tesseract OCR Engine<=5.5.3

Event History

Sep 10, 2026

CVE Published

via MITRE·05:38 PM

Data Sourced

via MITRE·05:38 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Tesseract versions should be treated as affected?

Version 5.5.3 and earlier are affected. No fixed release was available as of the review date.

Does switching OCR engines avoid the issue?