Tesseract OCR CVE-2026-88051

The attacker must control or influence which .traineddata model file Tesseract loads. Concrete delivery paths include: write access to a directory referenced by TESSDATA_PREFIX or the --tessdata-dir argument; an application interface that accepts user-supplied model file paths or uploaded model files; or a man-in-the-middle attack on an unauthenticated model download. The vulnerability fires only during legacy classifier initialization - specifically the TESSDATA_INTTEMP component at version_id ≥ 4 - so Tesseract instances configured with --oem 1 (LSTM-only) bypass the vulnerable path entirely. Exploitation is constrained to scenarios where attacker-controlled model content reaches the Tesseract process; this is not a vulnerability in parsing ordinary document images or text inputs.

The CVSS 4.0 score of 8.6 with AV:L is appropriate: exploitation requires the attacker to control which .traineddata file Tesseract loads, placing this outside pure network-reachable attack scenarios in default deployments. However, Tesseract is heavily embedded in document-processing pipelines, OCR-as-a-service platforms, and automated ingestion workflows where externally-supplied or user-uploaded model files may be accepted, meaningfully expanding the practical attack surface beyond a simple local-file scenario. The C:H/I:H/A:H impact triad reflects that heap out-of-bounds writes of structured FontInfo objects have historically been leveraged for controlled corruption beyond crash-only outcomes, though no working exploit is currently public. The combination of no fixed release, a confirmed upstream commit, and wide deployment in automated pipelines creates a meaningful patch-gap risk for downstream packagers. EPSS data is absent from the input; exploitation probability cannot be quantitatively estimated. Tesseract in LSTM-only mode (without the legacy classifier) does not load the vulnerable code path, which partially limits exposure in modern deployments.

An attacker crafts a malicious .traineddata file where the TESSDATA_INTTEMP component encodes reserved=4 and size_used_=65536, then delivers it to a target system - for example, by substituting a model file in an OCR service's model directory, via a supply-chain compromise of a model distribution, or through an application that accepts user-supplied model paths. When the target application initializes Tesseract with this model, fontinfo_table_.read writes 65,536 FontInfo structures into a 4-element heap buffer, corrupting adjacent heap memory. Depending on the heap layout and allocator internals, this results in a process crash or, with attacker-controlled heap grooming, potential code execution within the Tesseract process.