CVE-2026-88050: 
Linux Red Hat vulnerability analysis and mitigation

CVE-2026-88050 is an out-of-bounds write vulnerability in the Tesseract open-source OCR engine affecting versions 5.5.3 and earlier. The flaw exists in RecodedCharID::DeSerialize within src/ccutil/unicharcompress.h, which validates length_ but fails to validate individual code_[] values, allowing a crafted .traineddata file with a negative code value to trigger a wild-address crash or allocation failure in the default LSTM engine. It was published on September 10, 2026, with a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat CVE). No fixed release was available at the time of initial disclosure, though a patch commit has since been published (GitHub Commit).

The root cause is an incomplete input validation flaw (CWE-787: Out-of-bounds Write) introduced by the prior hardening commit 82727cc, which added only a length_ > kMaxCodeLen check to RecodedCharID::DeSerialize but left individual code_[] values unvalidated as raw signed int32. When a crafted .traineddata recoder component supplies code_[0] = 0xFFFFFFFF (i.e., -1 as a signed int32), UnicharCompress::ComputeCodeRange initializes code_range_ = -1 and uses a signed > comparison, so the value -1 never raises the maximum, yielding code_range_ = 0. SetupDecoder then calls is_valid_start_.resize(0) and immediately writes is_valid_start_[-1] = true on the size-zero std::vector<bool>, producing an out-of-bounds write at a large wrapped index. A secondary path with code_[0] = INT32_MAX wraps code_range_ negative, causing resize() to throw length_error or bad_alloc. The vulnerability is reachable via lstmrecognizer.cpp:200 when recoder_.DeSerialize is called on the default LSTM engine (GitHub Advisory, GitHub Commit).

Successful exploitation results in a denial-of-service condition: either a deterministic wild-address crash due to the out-of-bounds write into vector<bool> bit storage, or an unhandled length_error/bad_alloc exception that terminates the application. There is no evidence of confidentiality or integrity impact — the realistic outcome is application crash (availability impact: High), not reliable code execution. Any application or service that loads attacker-influenced .traineddata files using the Tesseract LSTM engine is within scope, including document processing pipelines, OCR-as-a-service platforms, and automated data extraction systems (GitHub Advisory).

A proof-of-concept exploit chain is publicly documented in the GitHub Security Advisory, detailing the precise .traineddata structure required to trigger the vulnerability (length_=1, code_[0]=0xFFFFFFFF). The SSVC assessment classifies exploitation as "poc" with no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is not automatable (SSVC: no) and requires the attacker to supply or influence the .traineddata model file loaded by the target application (GitHub Advisory, Red Hat CVE).

1. Craft malicious .traineddata file: Create a .traineddata file with an LSTM recoder component containing one RecodedCharID with length_ = 1 and code_[0] = 0xFFFFFFFF (serialized as a signed 32-bit little-endian integer, equal to -1). Ensure the model uses recoding, which is the default for modern LSTM models.
2. Deliver the malicious file to the target: Supply the crafted .traineddata to an application using Tesseract — via file upload interface, local filesystem write, network transfer, or by substituting a model file in a directory the application reads from.
3. Trigger deserialization: Cause the application to initialize LSTMRecognizer, which calls recoder_.DeSerialize on the crafted file. RecodedCharID::DeSerialize reads the negative code value without validation, as only length_ is checked.
4. Bypass incomplete validation: The length_ > kMaxCodeLen guard (added by commit 82727cc) passes because length_ = 1 is valid. The negative code_[0] = -1 value is accepted as a raw signed int32 with no further checks.
5. Trigger code_range_ miscalculation: ComputeCodeRange initializes code_range_ = -1 and iterates using a signed > comparison; since -1 never exceeds -1, code_range_ remains 0.
6. Trigger out-of-bounds write and crash: SetupDecoder calls is_valid_start_.resize(0) (succeeds), then writes is_valid_start_[-1] = true on the size-zero vector, producing an out-of-bounds write at a large wrapped index — causing a wild-address crash (DoS) (GitHub Advisory, GitHub Commit).

• File System: Unexpected or newly introduced .traineddata files in Tesseract model directories (e.g., /usr/share/tesseract-ocr/, /usr/local/share/tessdata/, or application-specific tessdata/ paths); .traineddata files with anomalously small file sizes or unusual modification timestamps.
• Process: Tesseract process or host application terminating unexpectedly with a segmentation fault (SIGSEGV), std::length_error, or std::bad_alloc exception during model load; core dump files generated in the working directory of the OCR process.
• Logs: Application logs showing crashes or unhandled exceptions during LSTMRecognizer initialization or .traineddata deserialization; system logs (e.g., /var/log/syslog, journalctl) recording process termination with signal 11 (SIGSEGV) for the Tesseract process.
• Network: Unusual file transfers delivering .traineddata files to systems running Tesseract, particularly from untrusted or external sources (GitHub Advisory).

No fixed release was available at the time of initial disclosure; however, a patch commit (c94a5532) has been merged into the Tesseract repository that validates each deserialized code_[i] value to be within [0, UINT16_MAX) and adds defense-in-depth bounds assertions to IsValidFirstCode and SetupDecoder (GitHub Commit). Users should monitor the Tesseract releases page and upgrade to a patched version as soon as one is tagged. In the interim, the official workaround is to only load .traineddata files from trusted, verified sources and to implement strict access controls on model file directories. Additional mitigations include validating .traineddata file integrity using cryptographic signatures, sandboxing OCR processing to limit crash impact, and monitoring for unexpected process terminations (GitHub Advisory).

The vulnerability was reported by researcher Zhixi "Jace" Sun (GitHub: @manus-use) and the advisory was published by Tesseract maintainer Stefan Weil (stweil) on August 25, 2026 (GitHub Advisory). The patch commit credits OpenCode/qwen3.8-27b-thinking (Alibaba Cloud) as an AI assistant in the fix development. Red Hat tracked the issue via Bugzilla and published a CVE entry shortly after disclosure (Red Hat CVE). No significant broader media coverage or notable community controversy has been identified beyond standard CVE aggregator coverage.