RLSA-2026:98624: Important: tesseract security update
A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005.
Security Fix(es):
tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data (CVE-2026-88048)
tesseract: Tesseract: Stack buffer overflow via crafted .traineddata file (CVE-2026-88047)
tesseract: Tesseract: Heap out-of-bounds write allows arbitrary code execution or denial of service (CVE-2026-88049)
tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata model (CVE-2026-88051)
tesseract: Tesseract: Heap out-of-bounds write leads to heap corruption via crafted data file (CVE-2026-88053)
tesseract: Tesseract: Heap out-of-bounds write can lead to arbitrary code execution (CVE-2026-88052)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/tesseract-debugsourceto a version that resolves this vulnerability.Fixed in 0:5.3.4-11.el10_2 - Upgrade
Upgrade
rocky-linux/tesseract-develto a version that resolves this vulnerability.Fixed in 0:5.3.4-11.el10_2 - Upgrade
Upgrade
rocky-linux/tesseractto a version that resolves this vulnerability.Fixed in 0:5.3.4-11.el10_2 - Upgrade
Upgrade
rocky-linux/tesseract-debuginfoto a version that resolves this vulnerability.Fixed in 0:5.3.4-11.el10_2
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Rocky Linux packages are covered by this advisory?
The advisory lists tesseract, tesseract-devel, tesseract-debugsource, and tesseract-debuginfo.
What kind of attacker-controlled input is relevant to these issues?
Several issues are triggered by crafted data files, including crafted .traineddata files or models. Environments that process untrusted OCR data or language-training data are therefore relevant to triage.
Does exploitation require credentials or user interaction?
The provided CVSS vector indicates no privileges are required and no user interaction is required. It also identifies the attack vector as local.