CVE-2026-88052

Katalog CVE

CVSS 7.8 · High EPSS 0,18%

Kerentanan Improper Validation of Array Index pada tesseract-ocr tesseract ocr. Skor CVSS 3.1 7.8 (High) menurut github.com.

Deskripsi (NVD)

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharset.cpp trusts the declared unichar count as a loop bound and uses id as an unchecked index into the unichars vector. unichar_insert_backwards_compatible can leave the vector unchanged for an empty, duplicate, or already-encodable representation, causing id to become larger than unichars.size(). Subsequent set_* calls and the write to unichars[id].properties.enabled then write UNICHAR_PROPERTIES beyond the vector during initialization in both the default LSTM and legacy engines, causing heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.

Rincian

Terbit di NVD

10 September 2026

Terakhir diubah

16 September 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-129: Improper Validation of Array Index
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-2hm8-q5c7-c373 exploit · mitigasi · advisory vendor
• https://github.com/tesseract-ocr/tesseract/commit/2d04d640db2e8c7e3bab2369d599343b5a8b8443 patch