The vulnerability of the FullyConnected::De serialize function in the Tesseract OCR system allows attackers to compromise the confidentiality and accessibility of the protected information.

The vulnerability of the FullyConnected::De serialize function in the Tesseract OCR system is related to reading data beyond the allowable range in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and accessibility of the protected information...

CVE-2026-88048 Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matrix dimension mismatch

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni and no against the weight-matrix dimensions. During FullyConnected::Forward, MatrixDotVector in...

EUVD-2026-75591

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni and no against the weight-matrix dimensions. During FullyConnected::Forward, MatrixDotVector in...

CVE-2026-88048

Tesseract OCR (open source) is affected through version 5.5.3 and earlier. The flaw resides in FullyConnected::DeSerialize (src/lstm/fullyconnected.cpp), which fails to validate deserialized layer scalars ni_ and no_ against weight-matrix dimensions. During FullyConnected::Forward, MatrixDotVecto...