Tesseract OCR CVE-2026-88050

Exploitation requires that the attacker control the .traineddata file loaded by Tesseract - either by writing a malicious file to the language model directory accessible to the Tesseract process, or through any service interface that accepts user-supplied or externally fetched language model files. The CVSS 4.0 AV:L vector confirms local filesystem access to model files is the prerequisite. Only the LSTM engine deserialization path (UnicharCompress::DeSerialize → SetupDecoder) is in scope; the legacy OCR engine is not affected. Impact is strictly limited to availability (process crash) with no confidentiality or integrity consequences, as confirmed by VC:N/VI:N/VA:H in the provided vector. Exploitation does not require authentication to the host operating system - any principal that can place a file in the model directory or supply a model via an application interface can trigger the crash.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) yields a score of 6.9 (Medium), appropriately reflecting a local, availability-only impact with no confidentiality or integrity consequences. The local attack vector is the primary limiting factor: an attacker must control the .traineddata file consumed by the Tesseract process. In tightly controlled desktop deployments this is a significant barrier, but automated document-processing pipelines that dynamically fetch language models from external sources or allow user-supplied model files substantially increase realistic exposure - for example, even a mid-sized municipal IT team in tczew running OCR on citizen-uploaded documents should evaluate whether their pipeline accepts externally sourced model files, as that configuration would materially elevate risk. No public exploit code exists, no CISA KEV listing has been made, and EPSS data was not included in the source intelligence, leaving exploitation probability unquantified. The impact class is denial of service only; there is no code execution or data exfiltration path established by the available evidence.

An attacker operating a document-processing service that allows custom language model uploads crafts a .traineddata file whose recoder component encodes a single character with a code value of -1. When the service invokes Tesseract to OCR any document using that model, DeSerialize accepts the negative code, code_range_ is computed as zero, and SetupDecoder performs an out-of-bounds write against a zero-length is_valid_start_ vector, crashing the Tesseract process. The commit-level unit test recoder_test.cc documents the exact binary payload structure needed to reproduce this reliably.