{"id":"CVE-2026-88053","summary":"Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata","details":"Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validating them against MAX_NUM_CLASS_PRUNERS, MAX_NUM_CLASSES, and MAX_NUM_PROTO_SETS. The loops store heap pointers into fixed-capacity ClassPruners and ProtoSets arrays in INT_TEMPLATES_STRUCT and INT_CLASS_STRUCT, so an oversized count causes heap out-of-bounds pointer writes during legacy-classifier initialization before OCR begins, resulting in heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.","aliases":["GHSA-rphx-x795-5qjv"],"modified":"2026-09-12T08:07:33.961369Z","published":"2026-09-10T17:38:58.271Z","database_specific":{"cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88053.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88053.json"},{"type":"ADVISORY","url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-rphx-x795-5qjv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88053"},{"type":"FIX","url":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tesseract-ocr/tesseract","events":[{"introduced":"0"},{"fixed":"8b0574680f3b22f246ade6a4c8e3029104255c63"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"5.5.3"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["5.5.3","5.5.2","5.5.1","5.5.0","5.4.1","5.4.0","5.4.0-rc2","5.4.0-rc1","5.3.4","5.3.3","5.3.2","5.3.1","5.3.0","5.3.0-rc1","5.2.0","5.1.0","5.0.1","5.0.0","5.0.0-rc3","5.0.0-rc2","5.0.0-rc1","5.0.0-beta-20210916","5.0.0-alpha-20210401","5.0.0-alpha-20201231","5.0.0-alpha-20201224","5.0.0-alpha","4.1.0-rc1","4.0.0","4.0.0-rc4","4.0.0-rc3","4.0.0-beta.4","4.0.0-beta.3","4.0.0-beta.1","4.00.00dev","4.00.00alpha","4.0.0-alpha","3.03-rc1","3.05.00dev","3.04.00","3.02.02","3.01","3.00","2.04","2.03","2.02","2.01","2.00","1.04b","1.04","1.03"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88053.json","vanir_signatures_modified":"2026-09-12T08:07:33Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/classify/adaptive.h"},"deprecated":false,"digest":{"line_hashes":["99916615886072456405370999225464298119","253861413240789516349691064130855008515","48145689155237412139485639691412287270","200096515663438798490593445210609950629","190169657698539759340859455254980909934","281179747869437790411709184632437624735","211738946670982766316035569069652267703","27161789080399959801714758530879606344","2283141662816754473055463681635142709","103296777887640836670573856295082771450","250597832640728917190629903614415161425","284338689383890915192969428012762082907","302633420983676324982774424234309781024","206453254636499339021080928275735706012","72435459411657402897516660617155987767","145480631527429478240406968964398306976","300457598953638873899213336001947869040"],"threshold":0.9},"id":"CVE-2026-88053-0ecf07b8"},{"deprecated":false,"digest":{"line_hashes":["309919401245736660023406194482941439058","35996280412127130285333420173766513576","303727910164062849211007464100295539295","276554733663723937051595801333207270775","184461593111928255103453243180953999287","63520714855495353863657895332432257961","239840052735626950229757802515450168797","309638635356541244795322202441791151467"],"threshold":0.9},"id":"CVE-2026-88053-0fbfee99","signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/wordrec/wordrec.h"}},{"source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"function":"Classify::BaselineClassifier","file":"src/classify/adaptmatch.cpp"},"deprecated":false,"digest":{"function_hash":"323033970858635033850685854498140139046","length":975},"id":"CVE-2026-88053-11831579","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"260729400276828142516469597352229551693","length":341},"id":"CVE-2026-88053-121a0c8f","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/classify/adaptive.cpp","function":"ADAPT_TEMPLATES_STRUCT::ADAPT_TEMPLATES_STRUCT"}},{"deprecated":false,"digest":{"line_hashes":["301574700504403499000736092668791203251","8308320358192487189582153031594198666","13850021865909168219330837074153436824","83843775490452924526423488135836038862","293193086057384639697016995782948385294","213800157025719690839714679965825530416","213287759752146589737057151972390589466","262706787172058086257093444908319806611","259596220991304125357166682075383599070","181896395657812361255622588739430206063","72382015252896047811735594134952641336","143299897603506155808480401670389246791","147340364642117766262200813230727945480","85859205045231425799767424692607430657","94547812916834188503239291395341887068"],"threshold":0.9},"id":"CVE-2026-88053-16b49af0","signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/wordrec/tface.cpp"}},{"source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/classify/classify.h"},"deprecated":false,"digest":{"line_hashes":["275751253636675989010692694757397212117","176679711152654053184987362067284867404","209014558649775976868678048629230511721","294328708098762512180241700595071736846"],"threshold":0.9},"id":"CVE-2026-88053-171eb5ff","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-88053-2a8844fb","signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/classify/intproto.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["146644213222410039845365681054699527667","261114122643368128869281682849613562507","74395978889695655541463480227028585475","135166203607443572113235165107231136071","204523328529257946963269883159463251535","64844808727609473407967410432323417611","296473863047011567975867189689295676680","98734041515341494218364861900192376024","4190785348185840785040785771046536497","300395113161621013935037624492231854133","160799872142454335834844156173892652381","265920828040286759682596599486724633886","51763250147400594592233560978770028929","106691270558985559585736981444705613078","117008100792445050483505330682431366901","185605070129061911491487841046860125477","79179507698905547939051160770747805569","287246283599883436873112081999841820198","153985853738067535974487725947107715899","56424434336499093858088362052363065785"]}},{"digest":{"function_hash":"86205707806250388267945315406509122534","length":128},"id":"CVE-2026-88053-32e7cb8a","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/classify/intproto.cpp","function":"INT_CLASS_STRUCT::~INT_CLASS_STRUCT"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"93586927756555709598243974455145083038","length":6606},"id":"CVE-2026-88053-3455eb9c","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/classify/intproto.cpp","function":"Classify::ReadIntTemplates"}},{"target":{"file":"src/classify/adaptive.cpp","function":"Classify::ReadAdaptedTemplates"},"deprecated":false,"digest":{"function_hash":"80405285789238084377946447904358596493","length":357},"id":"CVE-2026-88053-54730878","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63"},{"target":{"file":"src/classify/adaptive.cpp","function":"ADAPT_CLASS_STRUCT::ADAPT_CLASS_STRUCT"},"deprecated":false,"digest":{"function_hash":"154079785289694190130166887310314363920","length":430},"id":"CVE-2026-88053-823d24f2","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63"},{"deprecated":false,"digest":{"function_hash":"54483450460509146712248088505968173457","length":614},"id":"CVE-2026-88053-853872fa","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/classify/intproto.cpp","function":"AddIntProto"}},{"deprecated":false,"digest":{"function_hash":"233294086704989025882178780671818992023","length":1004},"id":"CVE-2026-88053-860d6f66","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/classify/adaptive.cpp","function":"ReadAdaptedClass"}},{"signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"function":"INT_TEMPLATES_STRUCT::~INT_TEMPLATES_STRUCT","file":"src/classify/intproto.cpp"},"deprecated":false,"digest":{"function_hash":"272244398520596140295703130498509997123","length":237},"id":"CVE-2026-88053-8953cd3c","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["293981327589941240550013866623293771325","307664903690749864415432793967929798526","297076967248163719028154699810970271996","242103606809807397836836766166265310800","66906630363187770990401192469364404049","67308508076543619185298871289995432058","120362166184335235922166603920798369229","241459456662403030913924096566015128237","36432857179267762202024479108596558023","94699266279944316460387230494095874518","16234506917588645422280896866535169295","23675245105142428281117523868447937715","200563969402998796262703377271491980584","12500039025920826499008671698553223546","129766865981092777416513406966342340745","100791870569367624196417582809766370846","272894435800532658088404686830176921359","87631776540061132218543667438569804335","104498454244168707764425149273902303704","132857766010034035870009955635633697380","248883029597172753172919634650071274764","85861514509097002438207041162549651403","157218879137381856036780511137617958950","4380767916605599609480385917554893578","282897246490450525355982628085641167072","283499944037837614377455982161471239231","188978880559413239480672652583380257710","261229914748858294764684148564040596461","296519681930265567622541547500833952483","106499817729655731933404907289106626422","226603934957122881158476350172229498227","88377863173401880312396837275034242589","59092974860527655362798468160954400988","51268758437977303670884878195044506224","144974155441716795917875743714999015274","196305892308775852623931324441298660197","107965675887642922027555797394054999495","207308477050714680511893054962830965657","187238081520969815615062898489591578505","270941383183635881835648207256281873246","11384211999791377835749716437885614909","290425027399122052894662513001394305979","301298420072030517579180376705472126159","138978409715526677163647380844944231497","55523309063658078499524134893311991986","25484891478678552171295630899626218438","171108385802334950551927905272266631494","795663485395769799646672822988155469","204376582813940793789997165147443272417","81652039622618390587625288361065198364","229135702447733791078711761636630849510","208101186594917593493519569563468467766"],"threshold":0.9},"id":"CVE-2026-88053-89b3779b","signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/classify/adaptive.cpp"}},{"digest":{"function_hash":"193589711333308284196815600049808770915","length":284},"id":"CVE-2026-88053-986a7153","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/classify/intproto.cpp","function":"INT_TEMPLATES_STRUCT::INT_TEMPLATES_STRUCT"},"deprecated":false},{"id":"CVE-2026-88053-b1fa9843","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"function":"INT_CLASS_STRUCT::INT_CLASS_STRUCT","file":"src/classify/intproto.cpp"},"deprecated":false,"digest":{"length":506,"function_hash":"43158753341827869246543121784177981107"}},{"deprecated":false,"digest":{"line_hashes":["67259786737943841883506573956903835247","255683580835526685172880987430118596458","210915473585454558982106539225260663464","162683880856582758292899499206413202424","203381491165556589317910143973453319718","266154679590872437797137266056008024123","254437538149189111307619934244293926318","181763843770543189941800132335593938203","1120916219659333688012147447585353784","147664971945713127690981810338134178569","326456442169907578031909502462352936406","328368351498212135446983446558147165223","86341515207987120185076729050987327225","169571414026553208134981398805393098793","293111045048262548351792715882619557294","308391884527846067179164780196084539571","207454607558037220403474166222598605266","67020530081705873269246439228440186735","242250328674352219432253705758985889312","259817599148611742282831199712169406810","108544222289507935389577879140497783929","217446159733148738748594671076520802188","195949574876955127175111105848031775793","25928546441307104547746460633345336473","193394602816965229744571012964575924056","88022680636043230345348199443023515280","287065365921120663316268650071328552422","10206835438963343568102636082334715989"],"threshold":0.9},"id":"CVE-2026-88053-d4ff2afe","signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/classify/adaptmatch.cpp"}},{"id":"CVE-2026-88053-da6808e6","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/classify/adaptmatch.cpp","function":"Classify::InitAdaptiveClassifier"},"deprecated":false,"digest":{"function_hash":"231549094591691774552224280236691974131","length":1987}},{"id":"CVE-2026-88053-da8f3b8b","signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/ccmain/tessedit.cpp"},"deprecated":false,"digest":{"line_hashes":["16050144818207752048269516359649566528","257611795248413966289948199948434437364","99388611985770526487571399215187494592","213121428518978488144541286735557871505"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/wordrec/tface.cpp","function":"Wordrec::program_editup"},"deprecated":false,"digest":{"function_hash":"183925952101793850725570557281418193406","length":448},"id":"CVE-2026-88053-dbb919fa","signature_type":"Function"},{"digest":{"line_hashes":["180036161261810508182413766749409429452","56801815033996073320374278490138966962","151626053599053066336540489340383160763","263770026684695003981301523646576540905","298019165294404695252025630653895629684","195510573766819084791286262327893250198","92691968179788655268013882649721853035","95601341252808302864699886474508849953","67667025491605316314946018526820880443","271884419654193604039591449820501257451","209537524651714567163934972200415654193","30624400242775500510466757222451625697","201782900374324863684264097075861283195","239091073511994526435424584848963104704","59623670734005583312381337681213044022","180090335449734220665230747188378342486","328468469076088297430137430027242063386","63795532786031927599527205204930455626","171445126440029819937959350215559623022","223530902578948182180462574003620555624","338106525782022295999663453228589831429","240481091789421294256187067885010116084","16865772235135018971810645112269776675","43058357791096801886010216078397648900","168157543533539179628027368076472541711","94689716946774818211691461315121345754","288213347918898709894000785476933731481","207103922921535777937107047982946104402","16683820713267262622064695271407728842","15891833864333059529217150110580303885","3781132787380627595705928657361265049","78535164092391242133646138303827366882","197317758012704647714674335581024540267","180682522294408510343128553208317058834","83296570461949616508172104457577429236","88559769609531066430257529880874685902","78650227271976605410155262918568833738","222351871769642645037009111646751565427","301792836351122577449587366083911644609","129662312722328662910098783626178317377","332753037056028652336856176629427290714","96201246694482333586930656908565632099","334073809352652691723105007030689477212","273572321883703545322854231041342426255","73432677615756432957488097281753976919","23438861381572691043618508559871402685","318811729608763440127748754197954914904","272250619278734334615307663558091479754","243160311312676592351313712508093776119","170252980516861887541903237382999130298","315274154260498568735088264576032065483","316975745086673544157324356917780340072","70887415655245788065307931690788886509"],"threshold":0.9},"id":"CVE-2026-88053-dcccc07c","signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/classify/intproto.cpp"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63","target":{"file":"src/classify/adaptive.cpp","function":"ADAPT_TEMPLATES_STRUCT::~ADAPT_TEMPLATES_STRUCT"},"deprecated":false,"digest":{"function_hash":"165097164341654473010744809152042539585","length":179},"id":"CVE-2026-88053-f0ce287d","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}