CVE-2026-88049

Name of the Vulnerable Software and Affected Versions Tesseract versions 5.5.3 and earlier

Description A heap out-of-bounds write occurs during the first recognition step on the default LSTM engine when processing a crafted NT LSTM layer. This happens because NetworkIO::WriteTimeStepPart and NetworkIO::AddTimeStepPart in src/lstm/networkio.cpp lack bounds checks. Specifically, in the LSTM::Forward function within src/lstm/lstm.cpp, the source variable is sized based on the deserialized na field, while the WriteTimeStepPart count is determined by ns (derived from the CI gate WeightMatrix dim1() value). If ns is significantly larger than na , it leads to heap corruption, a system crash, or potentially controlled corruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.