CVE-2026-88053
- Source
- https://cve.org/CVERecord?id=CVE-2026-88053
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88053.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-88053
- Aliases
-
- GHSA-rphx-x795-5qjv
- Downstream
- Published
- 2026-09-10T17:38:58Z
- Modified
- 2026-09-12T08:07:33Z
- Severity
-
- 8.6 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata
- Details
-
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validating them against MAX_NUM_CLASS_PRUNERS, MAX_NUM_CLASSES, and MAX_NUM_PROTO_SETS. The loops store heap pointers into fixed-capacity ClassPruners and ProtoSets arrays in INT_TEMPLATES_STRUCT and INT_CLASS_STRUCT, so an oversized count causes heap out-of-bounds pointer writes during legacy-classifier initialization before OCR begins, resulting in heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-787" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88053.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88053.json
- https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-rphx-x795-5qjv
- https://nvd.nist.gov/vuln/detail/CVE-2026-88053
- https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63
Affected packages
Git / github.com/tesseract-ocr/tesseract
Affected ranges
- Type
- GIT
- Repo
- https://github.com/tesseract-ocr/tesseract
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "last_affected": "5.5.3" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
1.*
1.03
1.04
1.04b
2.*
2.00
2.01
2.02
2.03
2.04
3.*
3.00
3.01
3.02.02
3.03-rc1
3.04.00
3.05.00dev
4.*
4.0.0
4.0.0-alpha
4.0.0-beta.1
4.0.0-beta.3
4.0.0-beta.4
4.0.0-rc3
4.0.0-rc4
4.00.00alpha
4.00.00dev
4.1.0-rc1
5.*
5.0.0
5.0.0-alpha
5.0.0-alpha-20201224
5.0.0-alpha-20201231
5.0.0-alpha-20210401
5.0.0-beta-20210916
5.0.0-rc1
5.0.0-rc2
5.0.0-rc3
5.0.1
5.1.0
5.2.0
5.3.0
5.3.0-rc1
5.3.1
5.3.2
5.3.3
5.3.4
5.4.0
5.4.0-rc1
5.4.0-rc2
5.4.1
5.5.0
5.5.1
5.5.2
5.5.3
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88053.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"99916615886072456405370999225464298119",
"253861413240789516349691064130855008515",
"48145689155237412139485639691412287270",
"200096515663438798490593445210609950629",
"190169657698539759340859455254980909934",
"281179747869437790411709184632437624735",
"211738946670982766316035569069652267703",
"27161789080399959801714758530879606344",
"2283141662816754473055463681635142709",
"103296777887640836670573856295082771450",
"250597832640728917190629903614415161425",
"284338689383890915192969428012762082907",
"302633420983676324982774424234309781024",
"206453254636499339021080928275735706012",
"72435459411657402897516660617155987767",
"145480631527429478240406968964398306976",
"300457598953638873899213336001947869040"
],
"threshold": 0.9
},
"id": "CVE-2026-88053-0ecf07b8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/adaptive.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"309919401245736660023406194482941439058",
"35996280412127130285333420173766513576",
"303727910164062849211007464100295539295",
"276554733663723937051595801333207270775",
"184461593111928255103453243180953999287",
"63520714855495353863657895332432257961",
"239840052735626950229757802515450168797",
"309638635356541244795322202441791151467"
],
"threshold": 0.9
},
"id": "CVE-2026-88053-0fbfee99",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/wordrec/wordrec.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "323033970858635033850685854498140139046",
"length": 975
},
"id": "CVE-2026-88053-11831579",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/adaptmatch.cpp",
"function": "Classify::BaselineClassifier"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "260729400276828142516469597352229551693",
"length": 341
},
"id": "CVE-2026-88053-121a0c8f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/adaptive.cpp",
"function": "ADAPT_TEMPLATES_STRUCT::ADAPT_TEMPLATES_STRUCT"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"301574700504403499000736092668791203251",
"8308320358192487189582153031594198666",
"13850021865909168219330837074153436824",
"83843775490452924526423488135836038862",
"293193086057384639697016995782948385294",
"213800157025719690839714679965825530416",
"213287759752146589737057151972390589466",
"262706787172058086257093444908319806611",
"259596220991304125357166682075383599070",
"181896395657812361255622588739430206063",
"72382015252896047811735594134952641336",
"143299897603506155808480401670389246791",
"147340364642117766262200813230727945480",
"85859205045231425799767424692607430657",
"94547812916834188503239291395341887068"
],
"threshold": 0.9
},
"id": "CVE-2026-88053-16b49af0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/wordrec/tface.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"275751253636675989010692694757397212117",
"176679711152654053184987362067284867404",
"209014558649775976868678048629230511721",
"294328708098762512180241700595071736846"
],
"threshold": 0.9
},
"id": "CVE-2026-88053-171eb5ff",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/classify.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"146644213222410039845365681054699527667",
"261114122643368128869281682849613562507",
"74395978889695655541463480227028585475",
"135166203607443572113235165107231136071",
"204523328529257946963269883159463251535",
"64844808727609473407967410432323417611",
"296473863047011567975867189689295676680",
"98734041515341494218364861900192376024",
"4190785348185840785040785771046536497",
"300395113161621013935037624492231854133",
"160799872142454335834844156173892652381",
"265920828040286759682596599486724633886",
"51763250147400594592233560978770028929",
"106691270558985559585736981444705613078",
"117008100792445050483505330682431366901",
"185605070129061911491487841046860125477",
"79179507698905547939051160770747805569",
"287246283599883436873112081999841820198",
"153985853738067535974487725947107715899",
"56424434336499093858088362052363065785"
],
"threshold": 0.9
},
"id": "CVE-2026-88053-2a8844fb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/intproto.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "86205707806250388267945315406509122534",
"length": 128
},
"id": "CVE-2026-88053-32e7cb8a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/intproto.cpp",
"function": "INT_CLASS_STRUCT::~INT_CLASS_STRUCT"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "93586927756555709598243974455145083038",
"length": 6606
},
"id": "CVE-2026-88053-3455eb9c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/intproto.cpp",
"function": "Classify::ReadIntTemplates"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "80405285789238084377946447904358596493",
"length": 357
},
"id": "CVE-2026-88053-54730878",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/adaptive.cpp",
"function": "Classify::ReadAdaptedTemplates"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "154079785289694190130166887310314363920",
"length": 430
},
"id": "CVE-2026-88053-823d24f2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/adaptive.cpp",
"function": "ADAPT_CLASS_STRUCT::ADAPT_CLASS_STRUCT"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "54483450460509146712248088505968173457",
"length": 614
},
"id": "CVE-2026-88053-853872fa",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/intproto.cpp",
"function": "AddIntProto"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "233294086704989025882178780671818992023",
"length": 1004
},
"id": "CVE-2026-88053-860d6f66",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/adaptive.cpp",
"function": "ReadAdaptedClass"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "272244398520596140295703130498509997123",
"length": 237
},
"id": "CVE-2026-88053-8953cd3c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/intproto.cpp",
"function": "INT_TEMPLATES_STRUCT::~INT_TEMPLATES_STRUCT"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"293981327589941240550013866623293771325",
"307664903690749864415432793967929798526",
"297076967248163719028154699810970271996",
"242103606809807397836836766166265310800",
"66906630363187770990401192469364404049",
"67308508076543619185298871289995432058",
"120362166184335235922166603920798369229",
"241459456662403030913924096566015128237",
"36432857179267762202024479108596558023",
"94699266279944316460387230494095874518",
"16234506917588645422280896866535169295",
"23675245105142428281117523868447937715",
"200563969402998796262703377271491980584",
"12500039025920826499008671698553223546",
"129766865981092777416513406966342340745",
"100791870569367624196417582809766370846",
"272894435800532658088404686830176921359",
"87631776540061132218543667438569804335",
"104498454244168707764425149273902303704",
"132857766010034035870009955635633697380",
"248883029597172753172919634650071274764",
"85861514509097002438207041162549651403",
"157218879137381856036780511137617958950",
"4380767916605599609480385917554893578",
"282897246490450525355982628085641167072",
"283499944037837614377455982161471239231",
"188978880559413239480672652583380257710",
"261229914748858294764684148564040596461",
"296519681930265567622541547500833952483",
"106499817729655731933404907289106626422",
"226603934957122881158476350172229498227",
"88377863173401880312396837275034242589",
"59092974860527655362798468160954400988",
"51268758437977303670884878195044506224",
"144974155441716795917875743714999015274",
"196305892308775852623931324441298660197",
"107965675887642922027555797394054999495",
"207308477050714680511893054962830965657",
"187238081520969815615062898489591578505",
"270941383183635881835648207256281873246",
"11384211999791377835749716437885614909",
"290425027399122052894662513001394305979",
"301298420072030517579180376705472126159",
"138978409715526677163647380844944231497",
"55523309063658078499524134893311991986",
"25484891478678552171295630899626218438",
"171108385802334950551927905272266631494",
"795663485395769799646672822988155469",
"204376582813940793789997165147443272417",
"81652039622618390587625288361065198364",
"229135702447733791078711761636630849510",
"208101186594917593493519569563468467766"
],
"threshold": 0.9
},
"id": "CVE-2026-88053-89b3779b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/adaptive.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "193589711333308284196815600049808770915",
"length": 284
},
"id": "CVE-2026-88053-986a7153",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/intproto.cpp",
"function": "INT_TEMPLATES_STRUCT::INT_TEMPLATES_STRUCT"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "43158753341827869246543121784177981107",
"length": 506
},
"id": "CVE-2026-88053-b1fa9843",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/intproto.cpp",
"function": "INT_CLASS_STRUCT::INT_CLASS_STRUCT"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"67259786737943841883506573956903835247",
"255683580835526685172880987430118596458",
"210915473585454558982106539225260663464",
"162683880856582758292899499206413202424",
"203381491165556589317910143973453319718",
"266154679590872437797137266056008024123",
"254437538149189111307619934244293926318",
"181763843770543189941800132335593938203",
"1120916219659333688012147447585353784",
"147664971945713127690981810338134178569",
"326456442169907578031909502462352936406",
"328368351498212135446983446558147165223",
"86341515207987120185076729050987327225",
"169571414026553208134981398805393098793",
"293111045048262548351792715882619557294",
"308391884527846067179164780196084539571",
"207454607558037220403474166222598605266",
"67020530081705873269246439228440186735",
"242250328674352219432253705758985889312",
"259817599148611742282831199712169406810",
"108544222289507935389577879140497783929",
"217446159733148738748594671076520802188",
"195949574876955127175111105848031775793",
"25928546441307104547746460633345336473",
"193394602816965229744571012964575924056",
"88022680636043230345348199443023515280",
"287065365921120663316268650071328552422",
"10206835438963343568102636082334715989"
],
"threshold": 0.9
},
"id": "CVE-2026-88053-d4ff2afe",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/adaptmatch.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "231549094591691774552224280236691974131",
"length": 1987
},
"id": "CVE-2026-88053-da6808e6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/adaptmatch.cpp",
"function": "Classify::InitAdaptiveClassifier"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"16050144818207752048269516359649566528",
"257611795248413966289948199948434437364",
"99388611985770526487571399215187494592",
"213121428518978488144541286735557871505"
],
"threshold": 0.9
},
"id": "CVE-2026-88053-da8f3b8b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/ccmain/tessedit.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "183925952101793850725570557281418193406",
"length": 448
},
"id": "CVE-2026-88053-dbb919fa",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/wordrec/tface.cpp",
"function": "Wordrec::program_editup"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"180036161261810508182413766749409429452",
"56801815033996073320374278490138966962",
"151626053599053066336540489340383160763",
"263770026684695003981301523646576540905",
"298019165294404695252025630653895629684",
"195510573766819084791286262327893250198",
"92691968179788655268013882649721853035",
"95601341252808302864699886474508849953",
"67667025491605316314946018526820880443",
"271884419654193604039591449820501257451",
"209537524651714567163934972200415654193",
"30624400242775500510466757222451625697",
"201782900374324863684264097075861283195",
"239091073511994526435424584848963104704",
"59623670734005583312381337681213044022",
"180090335449734220665230747188378342486",
"328468469076088297430137430027242063386",
"63795532786031927599527205204930455626",
"171445126440029819937959350215559623022",
"223530902578948182180462574003620555624",
"338106525782022295999663453228589831429",
"240481091789421294256187067885010116084",
"16865772235135018971810645112269776675",
"43058357791096801886010216078397648900",
"168157543533539179628027368076472541711",
"94689716946774818211691461315121345754",
"288213347918898709894000785476933731481",
"207103922921535777937107047982946104402",
"16683820713267262622064695271407728842",
"15891833864333059529217150110580303885",
"3781132787380627595705928657361265049",
"78535164092391242133646138303827366882",
"197317758012704647714674335581024540267",
"180682522294408510343128553208317058834",
"83296570461949616508172104457577429236",
"88559769609531066430257529880874685902",
"78650227271976605410155262918568833738",
"222351871769642645037009111646751565427",
"301792836351122577449587366083911644609",
"129662312722328662910098783626178317377",
"332753037056028652336856176629427290714",
"96201246694482333586930656908565632099",
"334073809352652691723105007030689477212",
"273572321883703545322854231041342426255",
"73432677615756432957488097281753976919",
"23438861381572691043618508559871402685",
"318811729608763440127748754197954914904",
"272250619278734334615307663558091479754",
"243160311312676592351313712508093776119",
"170252980516861887541903237382999130298",
"315274154260498568735088264576032065483",
"316975745086673544157324356917780340072",
"70887415655245788065307931690788886509"
],
"threshold": 0.9
},
"id": "CVE-2026-88053-dcccc07c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/intproto.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "165097164341654473010744809152042539585",
"length": 179
},
"id": "CVE-2026-88053-f0ce287d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"target": {
"file": "src/classify/adaptive.cpp",
"function": "ADAPT_TEMPLATES_STRUCT::~ADAPT_TEMPLATES_STRUCT"
}
}
]
vanir_signatures_modified
"2026-09-12T08:07:33Z"