Tesseract OCR CVE-2026-88049

Exploitation requires the attacker to supply or substitute a crafted .traineddata file that is subsequently loaded by Tesseract for text recognition. The crafted file must contain an NT_LSTM (or NT_LSTM_SUMMARY) layer with gate matrix dimensions (specifically CI gate dim1 = ns_) inconsistent with the na_ field. The vulnerability is triggered on the very first recognition step using the default LSTM engine - no additional configuration beyond normal Tesseract invocation is required. Exploitation is limited by file-delivery access: applications that load only trusted, internally-managed model files from a protected path are not exposed to external attackers. There is no authentication, network service, or protocol involved - the attack surface is entirely the model-loading code path.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) scores 8.6, reflecting a locally-delivered attack with no privileges or user interaction required beyond the normal invocation of Tesseract with a model file. The local attack vector correctly limits scope to environments where an attacker can supply or replace a .traineddata file - this is realistic in OCR-as-a-service pipelines accepting user-supplied models, CI document processing, or multi-tenant systems sharing a model directory. The PR:N classification is accurate because Tesseract itself has no authentication gating model loading. No EPSS data is provided, no CISA KEV listing exists, and no public exploit code has been identified, so real-world exploitation risk is currently theoretical. The 'potentially controlled corruption' language in the advisory is an honest assessment of heap-write primitives - RCE is plausible but not demonstrated. The most significant risk amplifier is the absence of a released patch, leaving all 5.5.3-and-earlier deployments unmitigated until a tagged release is cut.

An attacker operating a document processing service that accepts user-specified language model files uploads a crafted .traineddata containing an NT_LSTM layer whose CI gate matrix has dim1 (i.e., ns_) set to a value much larger than the na_ field in the layer header. When Tesseract processes any document using this model, LSTM::Forward allocates source_ for na_ elements and then calls WriteTimeStepPart writing ns_ elements, overflowing the heap buffer; with a controlled heap layout this may achieve arbitrary code execution in the Tesseract worker process.