Tesseract up to 5.5.3 LSTM Engine src/lstm/networkio.cpp AddTimeStepPart heap-based overflow

Summaryinfo

A vulnerability labeled as critical has been found in Tesseract up to 5.5.3. Affected by this vulnerability is the function NetworkIO::WriteTimeStepPart/NetworkIO::AddTimeStepPart of the file src/lstm/networkio.cpp of the component LSTM Engine. Executing a manipulation can lead to heap-based overflow. This vulnerability is registered as CVE-2026-88049. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability has been found in Tesseract up to 5.5.3 and classified as critical. This vulnerability affects the function NetworkIO::WriteTimeStepPart/NetworkIO::AddTimeStepPart of the file src/lstm/networkio.cpp of the component LSTM Engine. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and NetworkIO::Randomize in src/lstm/networkio.cpp but left NetworkIO::WriteTimeStepPart and NetworkIO::AddTimeStepPart unchecked. In LSTM::Forward in src/lstm/lstm.cpp, source_ is sized from the independently deserialized na_ field while the WriteTimeStepPart count is ns_, which comes from the CI gate WeightMatrix dim1() value. A crafted NT_LSTM layer can make ns_ much larger than na_, causing a heap out-of-bounds write during the first recognition step on the default LSTM engine and resulting in heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-88049 since 09/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/10/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Tesseract

Version

• 5.5.0
• 5.5.1
• 5.5.2
• 5.5.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion