CVE-2026-88053

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA INTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validating them against MAX NUM CLASS PRUNERS, MAX NUM CLASSES, and MAX NUM PROTO SETS. The loops store heap pointers into fixed-capacity ClassPruners and ProtoSets arrays in INT TEMPLATES STRUCT and INT CLASS STRUCT, so an oversized count causes heap out-of-bounds pointer writes during legacy-classifier initialization before OCR begins, resulting in heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.