RHSA-2026:95085HighCVSS 8.4

Red Hat Security Advisory: tesseract security update

Published
November 4, 2026
Last Modified
November 6, 2026

🔗 CVE IDs covered (6)

CVE-2026-88047 →CVE-2026-88048 →CVE-2026-88049 →CVE-2026-88051 →CVE-2026-88052 →CVE-2026-88053 →

📋 Description

CVE-2026-88047 — tesseract: Tesseract: Stack buffer overflow via crafted .traineddata file CVE-2026-88048 — tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data CVE-2026-88049 — tesseract: Tesseract: Heap out-of-bounds write allows arbitrary code execution or denial of service CVE-2026-88051 — tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata model CVE-2026-88052 — tesseract: Tesseract: Heap out-of-bounds write can lead to arbitrary code execution CVE-2026-88053 — tesseract: Tesseract: Heap out-of-bounds write leads to heap corruption via crafted data file

🎯 Affected products35

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • tesseract-0:5.3.4-11.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • tesseract-0:5.3.4-11.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • tesseract-0:5.3.4-11.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • tesseract-0:5.3.4-11.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • tesseract-0:5.3.4-11.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • tesseract-debuginfo-0:5.3.4-11.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • tesseract-debuginfo-0:5.3.4-11.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • tesseract-debuginfo-0:5.3.4-11.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • tesseract-debuginfo-0:5.3.4-11.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • tesseract-debuginfo-0:5.3.4-11.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • tesseract-debugsource-0:5.3.4-11.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • tesseract-debugsource-0:5.3.4-11.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • tesseract-debugsource-0:5.3.4-11.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • tesseract-debugsource-0:5.3.4-11.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • tesseract-debugsource-0:5.3.4-11.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • tesseract-debugsource-0:5.3.4-11.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • tesseract-debugsource-0:5.3.4-11.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • tesseract-devel-0:5.3.4-11.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • tesseract-devel-0:5.3.4-11.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • tesseract-devel-0:5.3.4-11.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • tesseract-devel-0:5.3.4-11.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • tesseract-tools-debuginfo-0:5.3.4-11.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • tesseract-tools-debuginfo-0:5.3.4-11.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +5 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, avoid processing `.traineddata` files from untrusted or unknown sources. Additionally, consider running the Tesseract OCR engine in a sandboxed environment to limit the impact of potential exploitation. Workaround: To mitigate this issue, ensure that applications utilizing Tesseract only process `.traineddata` files from trusted and verified sources. Avoid processing `.traineddata` files obtained from untrusted or external origins. Workaround: To mitigate this issue, avoid processing `.traineddata` files from untrusted or unverified sources with Tesseract. Restricting the application's input to only trusted `.traineddata` files can prevent exploitation of this vulnerability. Workaround: To mitigate this issue, avoid processing `.traineddata` model files from untrusted or unknown sources. Ensure that Tesseract only processes models from trusted origins. If Tesseract is not required, consider removing the `tesseract` package to eliminate the attack surface. Workaround: To mitigate this vulnerability, avoid processing untrusted or malicious image and document files with Tesseract. If Tesseract is not essential for system operations, consider removing the `tesseract` package to eliminate the attack surface. If the `tesseract` package is removed, ensure that any dependent applications or services are not adversely affected. Workaround: To mitigate this vulnerability, ensure that Tesseract only processes .traineddata files from trusted sources. Avoid loading or processing .traineddata files from untrusted or unverified origins, as these could be specially crafted to trigger the heap corruption. If Tesseract must process untrusted input, consider running the application in a sandboxed environment to limit the potential impact of successful exploitation.

🔗 References (9)