CVE-2026-88048: 
Linux Red Hat vulnerability analysis and mitigation

CVE-2026-88048 is a heap out-of-bounds write and read vulnerability in Tesseract OCR engine's FullyConnected::DeSerialize function, caused by a failure to validate deserialized layer dimensions against weight-matrix dimensions. It affects Tesseract versions 5.5.3 and earlier, including the latest HEAD at the time of disclosure. The vulnerability was published on August 25, 2026 via a GitHub Security Advisory and assigned a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause (CWE-787: Out-of-bounds Write; CWE-125: Out-of-bounds Read) lies in FullyConnected::DeSerialize (src/lstm/fullyconnected.cpp), which delegates entirely to weights_.DeSerialize without verifying that the deserialized weight-matrix dimensions (wf_.dim1(), wf_.dim2()) match the layer's declared scalars ni_ and no_. During FullyConnected::Forward, MatrixDotVector in src/lstm/weightmatrix.cpp writes w.dim1() results into temp_line (sized from no_) and reads w.dim2()-1 inputs from curr_input (sized from ni_). An attacker can craft a .traineddata file with an NT_SOFTMAX layer declaring no_=1, ni_=1 but embedding a weight matrix with dim1=60000, dim2=2, causing MatrixDotVector to write 60,000 results into a 1-element buffer on the first recognition step. Matrix dimensions are only capped at UINT16_MAX; no cross-check against ni_/no_ exists at load time (GitHub Advisory, Fix Commit).

Successful exploitation results in heap memory corruption, application crash (denial of service), information disclosure from heap memory, and potentially controlled heap corruption that could enable arbitrary code execution. Because the NT_SOFTMAX/fully-connected layer is the output layer of every LSTM model, the vulnerability is triggered on essentially all Tesseract LSTM models when processing any image with a malicious .traineddata file. Confidentiality, integrity, and availability of the affected system are all rated High under CVSS v4.0 (GitHub Advisory).

No public proof-of-concept exploit code has been released and no in-the-wild exploitation has been observed as of the disclosure date (Feedly). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to supply a crafted .traineddata file to a Tesseract instance — a realistic scenario in applications that accept user-supplied OCR models or language data (GitHub Advisory).

1. Craft malicious .traineddata file: Create a serialized NT_SOFTMAX network layer with declared ni_=1, no_=1 but embed a weight matrix with dim1=60000, dim2=2. The serialized format includes a network header (type byte, training flags, ni, no, etc.) followed by a WeightMatrix block with the inflated dimensions and corresponding weight data (all zeros are sufficient).
2. Deliver the file to the target: Supply the crafted .traineddata file to a Tesseract instance — for example, by placing it in the tessdata directory of an application that accepts user-specified language/model files, or by exploiting a file upload feature in a web application using Tesseract.
3. Trigger OCR processing: Invoke Tesseract OCR on any image using the malicious model (e.g., tesseract image.png output -l malicious_model). Tesseract loads the .traineddata file and calls FullyConnected::DeSerialize, which passes the dimension check (only ni_>=0 and no_>=0 are verified).
4. Trigger out-of-bounds write/read: On the first recognition step, FullyConnected::Forward calls MatrixDotVector, which writes 60,000 results into a temp_line buffer sized for 1 element and reads dim2-1=1 input from curr_input sized for 1 — causing a heap out-of-bounds write of up to 65,535 rows.
5. Achieve impact: Depending on heap layout and attacker control over weight values, the result is a crash (denial of service), heap memory disclosure (information leak), or potentially controlled heap corruption enabling further exploitation (GitHub Advisory, Fix Commit).

• File System: Presence of unexpected or externally sourced .traineddata files in the Tesseract tessdata directory, particularly files with unusually small declared ni_/no_ values but large file sizes (due to oversized weight matrices).
• Process: Tesseract process crashing with segmentation fault or heap corruption signals (SIGSEGV, SIGABRT) during OCR processing; crash dumps referencing FullyConnected::Forward, MatrixDotVector, or MatrixDotVectorInternal in stack traces.
• Logs: Application error logs showing Tesseract failures or unexpected termination immediately after loading a .traineddata file; AddressSanitizer (ASan) reports of heap-buffer-overflow in weightmatrix.cpp around line 103/109.
• Network: In web-facing applications, HTTP requests uploading .traineddata files or specifying unusual model paths to Tesseract-backed OCR endpoints (GitHub Advisory).

A fix has been committed to the Tesseract repository (commit 103dc13) that adds dimension validation in FullyConnected::DeSerialize: the layer is now rejected at load time if weights_.Dim1() != no_ or weights_.Dim2() != ni_ + 1. Users should update to a patched release once available, or build from the patched HEAD. As an immediate workaround, restrict Tesseract to loading .traineddata files only from trusted, verified sources and avoid processing user-supplied model files. Running Tesseract with minimal privileges and in a sandboxed environment reduces the impact of exploitation (Fix Commit, GitHub Advisory).

The vulnerability was reported by Zhixi "Jace" Sun (GitHub: @manus-use) and the fix was authored by Stefan Weil (Tesseract maintainer) with AI assistance noted in the commit message. Red Hat tracked the issue via Bugzilla (Bug 2531546) and classified it as high severity. No significant broader media coverage or notable community debate has been observed beyond the standard vulnerability disclosure channels (GitHub Advisory, Red Hat Bugzilla).