rhsa-2026:95085
HIGH CVSS 8.4 csaf_redhat
Description
An update for tesseract is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Timeline
- Published
- 2026-11-04 11:48 UTC
- Last Modified
- 2026-11-04
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright © Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for tesseract is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005.\n\nSecurity Fix(es):\n\n* tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data (CVE-2026-88048)\n\n* tesseract: Tesseract: Stack buffer overflow via crafted .traineddata file (CVE-2026-88047)\n\n* tesseract: Tesseract: Heap out-of-bounds write allows arbitrary code execution or denial of service (CVE-2026-88049)\n\n* tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata model (CVE-2026-88051)\n\n* tesseract: Tesseract: Heap out-of-bounds write leads to heap corruption via crafted data file (CVE-2026-88053)\n\n* tesseract: Tesseract: Heap out-of-bounds write can lead to arbitrary code execution (CVE-2026-88052)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:95085",
"url": "https://access.redhat.com/errata/RHSA-2026:95085"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2531546",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531546"
},
{
"category": "external",
"summary": "2531550",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531550"
},
{
"category": "external",
"summary": "2531554",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531554"
},
{
"category": "external",
"summary": "2531566",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531566"
},
{
"category": "external",
"summary": "2531573",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531573"
},
{
"category": "external",
"summary": "2531579",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531579"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95085.json"
}
],
"title": "Red Hat Security Advisory: tesseract security update",
"tracking": {
"current_release_date": "2026-11-04T12:51:07+00:00",
"generator": {
"date": "2026-11-04T12:51:07+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHSA-2026:95085",
"initial_release_date": "2026-11-04T11:48:26+00:00",
"revision_history": [
{
"date": "2026-11-04T11:48:26+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-04T11:48:26+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-04T12:51:07+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "tesseract-0:5.3.4-11.el10_2.src",
"product": {
"name": "tesseract-0:5.3.4-11.el10_2.src",
"product_id": "tesseract-0:5.3.4-11.el10_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract@5.3.4-11.el10_2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "tesseract-0:5.3.4-11.el10_2.aarch64",
"product": {
"name": "tesseract-0:5.3.4-11.el10_2.aarch64",
"product_id": "tesseract-0:5.3.4-11.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract@5.3.4-11.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"product": {
"name": "tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"product_id": "tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract-debugsource@5.3.4-11.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"product": {
"name": "tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"product_id": "tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract-debuginfo@5.3.4-11.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"product": {
"name": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"product_id": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract-tools-debuginfo@5.3.4-11.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"product": {
"name": "tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"product_id": "tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract-devel@5.3.4-11.el10_2?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "tesseract-0:5.3.4-11.el10_2.ppc64le",
"product": {
"name": "tesseract-0:5.3.4-11.el10_2.ppc64le",
"product_id": "tesseract-0:5.3.4-11.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract@5.3.4-11.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"product": {
"name": "tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"product_id": "tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract-debugsource@5.3.4-11.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"product": {
"name": "tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"product_id": "tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract-debuginfo@5.3.4-11.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"product": {
"name": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"product_id": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract-tools-debuginfo@5.3.4-11.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"product": {
"name": "tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"product_id": "tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract-devel@5.3.4-11.el10_2?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "tesseract-0:5.3.4-11.el10_2.s390x",
"product": {
"name": "tesseract-0:5.3.4-11.el10_2.s390x",
"product_id": "tesseract-0:5.3.4-11.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract@5.3.4-11.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"product": {
"name": "tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"product_id": "tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract-debugsource@5.3.4-11.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"product": {
"name": "tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"product_id": "tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract-debuginfo@5.3.4-11.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"product": {
"name": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"product_id": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract-tools-debuginfo@5.3.4-11.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "tesseract-devel-0:5.3.4-11.el10_2.s390x",
"product": {
"name": "tesseract-devel-0:5.3.4-11.el10_2.s390x",
"product_id": "tesseract-devel-0:5.3.4-11.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract-devel@5.3.4-11.el10_2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "tesseract-0:5.3.4-11.el10_2.x86_64",
"product": {
"name": "tesseract-0:5.3.4-11.el10_2.x86_64",
"product_id": "tesseract-0:5.3.4-11.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract@5.3.4-11.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"product": {
"name": "tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"product_id": "tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract-debugsource@5.3.4-11.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"product": {
"name": "tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"product_id": "tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract-debuginfo@5.3.4-11.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"product": {
"name": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"product_id": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract-tools-debuginfo@5.3.4-11.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"product": {
"name": "tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"product_id": "tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tesseract-devel@5.3.4-11.el10_2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-0:5.3.4-11.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64"
},
"product_reference": "tesseract-0:5.3.4-11.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-0:5.3.4-11.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le"
},
"product_reference": "tesseract-0:5.3.4-11.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-0:5.3.4-11.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x"
},
"product_reference": "tesseract-0:5.3.4-11.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-0:5.3.4-11.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src"
},
"product_reference": "tesseract-0:5.3.4-11.el10_2.src",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-0:5.3.4-11.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64"
},
"product_reference": "tesseract-0:5.3.4-11.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64"
},
"product_reference": "tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le"
},
"product_reference": "tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-debuginfo-0:5.3.4-11.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x"
},
"product_reference": "tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64"
},
"product_reference": "tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-debugsource-0:5.3.4-11.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64"
},
"product_reference": "tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le"
},
"product_reference": "tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-debugsource-0:5.3.4-11.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x"
},
"product_reference": "tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-debugsource-0:5.3.4-11.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64"
},
"product_reference": "tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64"
},
"product_reference": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le"
},
"product_reference": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x"
},
"product_reference": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
},
"product_reference": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64"
},
"product_reference": "tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le"
},
"product_reference": "tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-debuginfo-0:5.3.4-11.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x"
},
"product_reference": "tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64"
},
"product_reference": "tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-debugsource-0:5.3.4-11.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64"
},
"product_reference": "tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le"
},
"product_reference": "tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-debugsource-0:5.3.4-11.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x"
},
"product_reference": "tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-debugsource-0:5.3.4-11.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64"
},
"product_reference": "tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-devel-0:5.3.4-11.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64"
},
"product_reference": "tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-devel-0:5.3.4-11.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le"
},
"product_reference": "tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-devel-0:5.3.4-11.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x"
},
"product_reference": "tesseract-devel-0:5.3.4-11.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-devel-0:5.3.4-11.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64"
},
"product_reference": "tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64"
},
"product_reference": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le"
},
"product_reference": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x"
},
"product_reference": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
},
"product_reference": "tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-88047",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input"
},
"discovery_date": "2026-09-10T16:32:12.679474+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531550"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Tesseract. This vulnerability, a stack buffer overflow, occurs when the OCR engine processes a specially crafted .traineddata file. An attacker can exploit this by providing a malformed input, leading to stack corruption, a denial of service (DoS), and potentially allowing for control-flow hijacking.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tesseract: Tesseract: Stack buffer overflow via crafted .traineddata file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because successful exploitation can result in stack memory corruption and potential control-flow hijacking within the application context. In Red Hat Enterprise Linux environments, Tesseract is an optional OCR library and command-line utility that typically loads verified system-provided language models. Impact is largely confined to deployments where untrusted or external legacy trained data files are explicitly accepted and processed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-88047"
},
{
"category": "external",
"summary": "RHBZ#2531550",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531550"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-88047",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-88047"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88047",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88047"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/commit/1bda5079b1c8a7e25f523486837426903d29ce84",
"url": "https://github.com/tesseract-ocr/tesseract/commit/1bda5079b1c8a7e25f523486837426903d29ce84"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-5j2p-r5vc-q7f3",
"url": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-5j2p-r5vc-q7f3"
}
],
"release_date": "2026-09-10T16:18:01.588000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T11:48:26+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95085"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid processing `.traineddata` files from untrusted or unknown sources. Additionally, consider running the Tesseract OCR engine in a sandboxed environment to limit the impact of potential exploitation.",
"product_ids": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tesseract: Tesseract: Stack buffer overflow via crafted .traineddata file"
},
{
"cve": "CVE-2026-88048",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-10T16:31:48.247406+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531546"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Tesseract. The `FullyConnected::DeSerialize` function does not properly validate the dimensions of deserialized layers against the weight-matrix dimensions. This vulnerability allows a remote attacker to provide a specially crafted `.traineddata` file, leading to a heap out-of-bounds write and read during the `FullyConnected::Forward` operation. Successful exploitation can result in heap corruption, application crashes, or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated with an Important severity impact because heap memory corruption from out-of-bounds writes could allow arbitrary code execution or denial of service in applications utilizing the OCR engine. In standard Red Hat Enterprise Linux installations, Tesseract operates using verified system language packs rather than user-supplied models. Risk is primarily limited to custom integrations or automated pipelines that load untrusted language data files.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-88048"
},
{
"category": "external",
"summary": "RHBZ#2531546",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531546"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-88048",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-88048"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88048",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88048"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/commit/103dc134eb36411ddc6833ec20aa2c76795bd0ff",
"url": "https://github.com/tesseract-ocr/tesseract/commit/103dc134eb36411ddc6833ec20aa2c76795bd0ff"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-q44c-23p6-5mw6",
"url": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-q44c-23p6-5mw6"
}
],
"release_date": "2026-09-10T16:21:57.587000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T11:48:26+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95085"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that applications utilizing Tesseract only process `.traineddata` files from trusted and verified sources. Avoid processing `.traineddata` files obtained from untrusted or external origins.",
"product_ids": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data"
},
{
"cve": "CVE-2026-88049",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-10T16:41:43.337151+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531554"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. A remote attacker could exploit a heap out-of-bounds write vulnerability in the `LSTM::Forward` function by providing a specially crafted input. This could lead to heap corruption, application crashes, or potentially controlled memory corruption, which may result in arbitrary code execution or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tesseract: Tesseract: Heap out-of-bounds write allows arbitrary code execution or denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because, although triggering it requires loading a manipulated language model file, successful exploitation can result in arbitrary code execution within the context of the executing user or application. In standard Red Hat deployments, Tesseract processes trusted data packages provided by the operating system, which limits exposure unless an environment permits user-supplied models. Systems that integrate the OCR engine into automated ingestion pipelines or services processing untrusted model assets face elevated exposure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-88049"
},
{
"category": "external",
"summary": "RHBZ#2531554",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531554"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-88049",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-88049"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88049",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88049"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/commit/b494ac18925f9d9aff9ef5815475de9943ab19bf",
"url": "https://github.com/tesseract-ocr/tesseract/commit/b494ac18925f9d9aff9ef5815475de9943ab19bf"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-jgq8-pprg-vc68",
"url": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-jgq8-pprg-vc68"
}
],
"release_date": "2026-09-10T16:23:18.718000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T11:48:26+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95085"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid processing `.traineddata` files from untrusted or unverified sources with Tesseract. Restricting the application's input to only trusted `.traineddata` files can prevent exploitation of this vulnerability.",
"product_ids": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tesseract: Tesseract: Heap out-of-bounds write allows arbitrary code execution or denial of service"
},
{
"cve": "CVE-2026-88051",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-10T17:40:53.817120+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531566"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. A heap out-of-bounds write vulnerability exists in the GenericVector::read function when processing a specially crafted .traineddata model. By manipulating the reserved and size_used_ fields, a local attacker can cause heap corruption, a crash, or potentially controlled corruption, which could lead to arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata model",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important for Red Hat Enterprise Linux because successful exploitation of the memory corruption flaw can result in arbitrary code execution within the context of the user or process running the OCR engine. In standard Red Hat deployments, Tesseract relies on verified system-provided language packs, limiting exposure unless an application or user is tricked into loading an untrusted, malicious trained data file. Because triggering the condition requires local file interaction or supplying a specially prepared model to an automated ingestion pipeline, remote unauthenticated exploitation without user interaction is not possible.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-88051"
},
{
"category": "external",
"summary": "RHBZ#2531566",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531566"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-88051",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-88051"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88051",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88051"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/commit/56e09ca12e751623fe796ce1554ce704bffd2ef0",
"url": "https://github.com/tesseract-ocr/tesseract/commit/56e09ca12e751623fe796ce1554ce704bffd2ef0"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-88qp-4g94-3rf3",
"url": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-88qp-4g94-3rf3"
}
],
"release_date": "2026-09-10T17:37:01.063000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T11:48:26+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95085"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid processing `.traineddata` model files from untrusted or unknown sources. Ensure that Tesseract only processes models from trusted origins. If Tesseract is not required, consider removing the `tesseract` package to eliminate the attack surface.",
"product_ids": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata model"
},
{
"cve": "CVE-2026-88052",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-10T17:51:56.812840+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531579"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. The UNICHARSET::load_via_fgets function incorrectly trusts a declared character count, which can lead to an out-of-bounds write in memory. A remote attacker could exploit this vulnerability by providing a specially crafted input, potentially causing heap corruption, a denial of service, or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tesseract: Tesseract: Heap out-of-bounds write can lead to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity flaw because an out-of-bounds heap write could allow an attacker to achieve arbitrary code execution in the context of the running process, rather than a crash alone. Within Red Hat Enterprise Linux environments, Tesseract is typically deployed as a standalone utility or linked library in automated data extraction pipelines. Exploitation is constrained by the prerequisite that an application or user must process malicious character set definitions or untrusted model files, preventing direct unauthenticated remote exploitation under default configurations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-88052"
},
{
"category": "external",
"summary": "RHBZ#2531579",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531579"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-88052",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-88052"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88052",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88052"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/commit/2d04d640db2e8c7e3bab2369d599343b5a8b8443",
"url": "https://github.com/tesseract-ocr/tesseract/commit/2d04d640db2e8c7e3bab2369d599343b5a8b8443"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-2hm8-q5c7-c373",
"url": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-2hm8-q5c7-c373"
}
],
"release_date": "2026-09-10T17:38:04.675000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T11:48:26+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95085"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, avoid processing untrusted or malicious image and document files with Tesseract. If Tesseract is not essential for system operations, consider removing the `tesseract` package to eliminate the attack surface. If the `tesseract` package is removed, ensure that any dependent applications or services are not adversely affected.",
"product_ids": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tesseract: Tesseract: Heap out-of-bounds write can lead to arbitrary code execution"
},
{
"cve": "CVE-2026-88053",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-10T17:51:23.533168+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531573"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. A local attacker could provide a specially crafted `.traineddata` file, which, when processed, could lead to a heap out-of-bounds write. This vulnerability occurs due to unvalidated counts used as loop bounds during legacy-classifier initialization. Successful exploitation could result in heap corruption, causing a crash or potentially controlled corruption of memory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tesseract: Tesseract: Heap out-of-bounds write leads to heap corruption via crafted data file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity flaw because an adversary who successfully triggers the memory corruption can execute arbitrary code within the privileges of the running application, rather than solely causing a denial of service. In Red Hat Enterprise Linux, Tesseract operates as an optical character recognition utility and shared library that typically handles language models bundled directly from verified system packages. Exploitation requires an application to load a malicious training model, meaning risk is concentrated in automated pipelines or services configured to accept external, unvetted language data files.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-88053"
},
{
"category": "external",
"summary": "RHBZ#2531573",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531573"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-88053",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-88053"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88053",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88053"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63",
"url": "https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-rphx-x795-5qjv",
"url": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-rphx-x795-5qjv"
}
],
"release_date": "2026-09-10T17:38:58.271000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T11:48:26+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95085"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that Tesseract only processes .traineddata files from trusted sources. Avoid loading or processing .traineddata files from untrusted or unverified origins, as these could be specially crafted to trigger the heap corruption. If Tesseract must process untrusted input, consider running the application in a sandboxed environment to limit the potential impact of successful exploitation.",
"product_ids": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.src",
"AppStream-10.2.Z:tesseract-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"AppStream-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-debugsource-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-devel-0:5.3.4-11.el10_2.x86_64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.s390x",
"CRB-10.2.Z:tesseract-tools-debuginfo-0:5.3.4-11.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tesseract: Tesseract: Heap out-of-bounds write leads to heap corruption via crafted data file"
}
]
}