Tesseract OCR CVE-2026-88052

Exploitation requires a Tesseract process to call load_via_fgets on an attacker-controlled unicharset file containing either a duplicate character representation (same glyph appearing more than once), an empty representation, or an already-encodable representation that causes unichar_insert_backwards_compatible to perform a no-op insertion. In a direct interactive scenario, a user must be induced to invoke Tesseract against the malicious file (CVSS UI:R). In automated pipeline scenarios where an application ingests documents from untrusted sources and the associated unicharset files can be influenced - for example, document format parsers that extract embedded character tables, or pipelines that fetch tessdata from user-specified URIs - the user-interaction requirement is satisfied by the pipeline's own processing logic, effectively converting the attack surface to network-reachable. Deployments using only official, integrity-verified tessdata unicharset files from the tesseract-ocr distribution are not exploitable in the default configuration, provided those files have not been tampered with. No authentication or elevated privilege is required to pass a file to Tesseract for processing.

The CVSS 7.8 score with AV:L/AC:L/PR:N/UI:R accurately characterizes this as a client-side file-processing vulnerability; exploitation requires a Tesseract process to actually load a crafted unicharset file, either via direct user invocation or an automated document-processing pipeline. No CISA KEV listing and no EPSS score are available in the provided data, so exploitation probability cannot be quantitatively benchmarked, and there is no public exploit identified at time of analysis. That said, the fix commit's embedded test cases provide a precise, minimal reproduction: a three-entry file with a duplicate representation is sufficient to trigger the out-of-bounds write, meaning the technical barrier to constructing a triggering payload is low. The absence of a released patched version is a meaningful risk amplifier - even a mid-sized municipal IT team in sopot running automated OCR workflows cannot upgrade to a clean release and must instead apply a source patch or deploy compensating controls. Applications that automatically ingest documents from untrusted sources and pass them to Tesseract effectively transform the AV:L/UI:R vector into a network-reachable attack surface, raising real-world risk materially above what the base CVSS suggests for interactive use.

An attacker crafts a unicharset file declaring three characters but listing the first character ('A') twice - exactly the structure demonstrated in the fix commit's test case RejectsDuplicateRepresentation. When an automated OCR pipeline ingests a document whose associated or embedded unicharset file has been substituted with this malformed version, Tesseract's load_via_fgets increments id past the actual unichars vector size, and the subsequent write to unichars[2].properties.enabled corrupts heap metadata, triggering either an immediate crash of the OCR worker or, with heap-grooming effort, a controlled write primitive for code execution.