Tesseract OCR CVE-2026-88047

Exploitation requires the attacker to control or substitute the .traineddata training data file passed to TessBaseAPI::Init. This file must be processed by Tesseract's legacy OCR engine specifically - the LSTM-based engine does not invoke ReadNormProtos and is not affected. The application must be compiled against libstdc++; builds using Apple's libc++ C++20 are incidentally protected by the bounded array overload. No system-level authentication or privileges are required - the attacker only needs a path to place the crafted file where the application will load it. Applications that load only system-installed, package-manager-distributed training data from trusted sources are not realistically exploitable.

The CVSS 4.0 score of 8.6 (AV:L/AC:L/AT:N/PR:N/UI:N) reflects low attack complexity and high impact potential but a local attack vector requiring control of the .traineddata file. Real-world risk is strongly deployment-dependent: applications accepting user-supplied OCR language packs face meaningful exposure, while those loading only system-installed, package-manager-distributed training data face negligible risk. No EPSS data is provided and the vulnerability does not appear in CISA KEV, indicating no confirmed active exploitation. No public exploit code exists beyond the fix commit's regression test case. The CVSS 4.0 vector's UI:N metric may overstate accessibility - in most deployments, a user or operator must initiate OCR processing, implying active user interaction. The legacy engine dependency is an important limiting factor: applications using only the LSTM-based engine are entirely unaffected. Platform heterogeneity is a key differentiator: Linux libstdc++ builds are vulnerable while macOS Apple libc++ C++20 builds are incidentally protected.

An attacker who can supply or substitute a .traineddata file - for example by exploiting a file-upload path in a document processing application or social-engineering a user into loading a custom language pack - crafts the NORMPROTO component with a unichar token exceeding 60 characters. When the target application calls TessBaseAPI::Init with the legacy engine using that file, ReadNormProtos overflows the unichar stack buffer by up to 39 bytes, potentially overwriting the saved return address to redirect execution to attacker-controlled code. No public exploit code exists at time of analysis, but the fix commit's regression test (normproto_test.cc) explicitly demonstrates the overflow condition using a 99-character token.