CVE-2026-88049: 
Linux Red Hat vulnerability analysis and mitigation

CVE-2026-88049 is a heap out-of-bounds write vulnerability in the Tesseract open-source OCR engine affecting versions 5.5.3 and earlier. The flaw resides in the LSTM layer processing logic, where a crafted .traineddata file can trigger a heap buffer overflow during OCR recognition. It was publicly disclosed on September 10, 2026, via a GitHub Security Advisory. The vulnerability carries a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an incomplete fix from a prior security patch (commit 2f4d2f4, CVE-2026-73066), which added bounds checks to NetworkIO::CopyTimeStepGeneral and NetworkIO::Randomize but left NetworkIO::WriteTimeStepPart and NetworkIO::AddTimeStepPart unchecked (CWE-787: Out-of-bounds Write). In LSTM::Forward (lstm.cpp), the source_ buffer is allocated based on the independently deserialized na_ field, while the write count passed to WriteTimeStepPart is ns_, derived from the CI gate WeightMatrix dim1() — a separate, independently deserialized value capped only at UINT16_MAX. An attacker can craft an NT_LSTM layer with na_=2 and a CI gate WeightMatrix dim1=60000, causing WriteTimeStepPart to write 60,000 floats (~240 KB) into a buffer sized for approximately 2 elements. No consistency check between na_ and gate-matrix dimensions exists anywhere in lstm.cpp or network.cpp on affected versions (GitHub Advisory, Fix Commit).

Successful exploitation results in a ~240 KB heap out-of-bounds write past the source_ buffer during the first line recognition step, leading to heap corruption, application crash (denial of service), or potentially controlled memory corruption enabling arbitrary code execution. The vulnerability affects confidentiality, integrity, and availability of the vulnerable system at a high level. In environments where Tesseract processes untrusted OCR model files (e.g., document processing pipelines, cloud OCR services), an attacker who can supply a malicious .traineddata file could escalate to remote code execution if heap layout is predictable (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit sequence is publicly documented in the GitHub Security Advisory, describing the exact crafted .traineddata parameters needed to trigger the overflow. The NVD SSVC assessment classifies exploitation as "poc" with no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a crafted .traineddata file to a Tesseract process and trigger OCR on any image — no authentication is required if the application processes untrusted OCR models (GitHub Advisory, Red Hat Bugzilla).

1. Craft malicious .traineddata file: Create a .traineddata file containing an NT_LSTM layer with ni_=1, na_=2, and a CI gate WeightMatrix with dim1=60000. The na_ field is deserialized at lstm.cpp:254 with no validation; the CI matrix dim1 is deserialized independently and capped only at UINT16_MAX.
2. Deliver the malicious file: Place the crafted .traineddata file in a location accessible to the Tesseract process — e.g., by substituting a legitimate language model file, exploiting a file upload feature in an application using Tesseract, or via a supply chain attack on model distribution.
3. Load the file via Network::CreateFromFile: When Tesseract loads the model, Network::CreateFromFile (network.cpp:250) performs only basic checks (ni/no/num_weights >= 0) and caps matrix dimensions at 60,000 — no consistency check between na_ and gate-matrix dimensions occurs.
4. Initiate OCR processing on any image: Trigger OCR on any image. LSTM::Forward calls ResizeForward, which sizes the source_ buffer using RoundInputs(na_), resulting in allocation for approximately 2 float elements (lstm.cpp:845).
5. Trigger the heap out-of-bounds write: During LSTM::Forward at lstm.cpp:368, source_.WriteTimeStepPart(t, ni_+nf_, ns_=60000, curr_output) is called. NetworkIO::WriteTimeStepPart (networkio.cpp:664) has no bounds check, writing 60,000 floats (~240 KB) into the ~2-element buffer, corrupting adjacent heap structures.
6. Achieve impact: The heap corruption results in a crash (DoS) or, with knowledge of heap layout, may enable controlled memory corruption for arbitrary code execution (GitHub Advisory, Fix Commit).

• File System: Unexpected or modified .traineddata files in Tesseract's tessdata directory (e.g., /usr/share/tesseract-ocr/, /usr/local/share/tessdata/); .traineddata files with anomalously small file sizes or unusual modification timestamps compared to official releases.
• Process: Tesseract process (tesseract) crashing unexpectedly or producing segmentation faults during OCR operations; unusual child processes spawned by the Tesseract process (e.g., shells, network utilities) if exploitation leads to code execution.
• Logs: Application crash logs or core dumps referencing LSTM::Forward, WriteTimeStepPart, or networkio.cpp; AddressSanitizer (ASan) reports indicating heap-buffer-overflow in WriteTimeStepPart or AddTimeStepPart.
• Network: Outbound connections from the Tesseract process or its parent application to unexpected external hosts, which may indicate post-exploitation activity if code execution is achieved (GitHub Advisory).

No fixed release was available at the time of initial disclosure; however, a remediation commit (b494ac1) has been merged into the Tesseract repository that validates LSTM gate matrix dimensions against na_/no_ at load time in LSTM::DeSerialize, and adds bounds assertions to WriteTimeStepPart and AddTimeStepPart in networkio.cpp. Users should update to a release that includes commit b494ac18925f9d9aff9ef5815475de9943ab19bf once a tagged release is available. As an immediate workaround, restrict Tesseract to processing only .traineddata files from trusted, verified sources; implement sandboxing (e.g., containers, seccomp) around OCR processing operations; and consider disabling LSTM engine support if the use case permits (GitHub Advisory, Fix Commit, Red Hat Bugzilla).

The vulnerability was reported by researcher Zhixi "Jace" Sun (GitHub: @manus-use) and the advisory was published by Tesseract maintainer Stefan Weil. Red Hat's Product Security team tracked the issue via Bugzilla and classified it as high severity. The fix commit credits OpenCode/qwen3.8-27b-thinking (Alibaba Cloud) as an AI-assisted contributor to the remediation. No significant broader media coverage or notable social media discussion beyond automated CVE tracking feeds was observed at the time of disclosure (GitHub Advisory, Red Hat Bugzilla).