Bug 2531546 (CVE-2026-88048) - CVE-2026-88048 tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data
Summary: CVE-2026-88048 tesseract: Tesseract: Heap out-of-bounds write/read leading to...
Keywords:
Status: NEW
Alias: CVE-2026-88048
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2531774
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-10 16:32 UTC by OSIDB Bzimport
Modified: 2026-09-11 07:40 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-10 16:32:25 UTC
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni_ and no_ against the weight-matrix dimensions. During FullyConnected::Forward, MatrixDotVector in src/lstm/weightmatrix.cpp writes w.dim1() results into temp_line, which is sized from no_, and reads w.dim2() minus one inputs from curr_input, which is sized from ni_. A crafted .traineddata NT_SOFTMAX layer can therefore use inconsistent dimensions to cause a heap out-of-bounds write and read on the default LSTM engine, resulting in heap corruption, a crash, information disclosure, or potentially controlled corruption. No fixed release is available as of this review.


Note You need to log in before you can comment on or make changes to this bug.