https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-88054.htmlhttps://patchthecve.com/cve/CVE-2026-88054.htmlWed, 16 Sep 2026 16:14:01 +0000MEDIUM 5.5: Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks but accepts a zero-length stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED layers in a crafted .traineddata model. During LSTMRecognizer initihttps://patchthecve.com/cve/CVE-2026-88053.htmlhttps://patchthecve.com/cve/CVE-2026-88053.htmlWed, 16 Sep 2026 16:14:31 +0000HIGH 7.8: Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validatinghttps://patchthecve.com/cve/CVE-2026-88052.htmlhttps://patchthecve.com/cve/CVE-2026-88052.htmlWed, 16 Sep 2026 16:21:10 +0000HIGH 7.8: Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharset.cpp trusts the declared unichar count as a loop bound and uses id as an unchecked index into the unichars vector. unichar_insert_backwards_compatible can leave the vector unchanghttps://patchthecve.com/cve/CVE-2026-88051.htmlhttps://patchthecve.com/cve/CVE-2026-88051.htmlWed, 16 Sep 2026 16:29:47 +0000HIGH 7.8: Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and size_used_ from a .traineddata model without a cap or an invariant check. reserve(reserved) allocates the backihttps://patchthecve.com/cve/CVE-2026-88050.htmlhttps://patchthecve.com/cve/CVE-2026-88050.htmlMon, 14 Sep 2026 20:02:01 +0000MEDIUM 5.5: Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can https://patchthecve.com/cve/CVE-2026-88049.htmlhttps://patchthecve.com/cve/CVE-2026-88049.htmlMon, 14 Sep 2026 20:01:48 +0000MEDIUM 5.5: Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and NetworkIO::Randomize in src/lstm/networkio.cpp but left NetworkIO::WriteTimeStepPart and NetworkIO::AddTimeStepPart unchecked. In LSTM::Forwardhttps://patchthecve.com/cve/CVE-2026-88048.htmlhttps://patchthecve.com/cve/CVE-2026-88048.htmlMon, 14 Sep 2026 20:01:33 +0000HIGH 7.1: Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni_ and no_ against the weight-matrix dimensions. During FullyConnected::Forward, MatrixDotVector in src/lstm/weightmatrixhttps://patchthecve.com/cve/CVE-2026-88047.htmlhttps://patchthecve.com/cve/CVE-2026-88047.htmlMon, 14 Sep 2026 20:01:21 +0000HIGH 7.8: Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadNormProtos in src/classify/normmatch.cpp parses the NORMPROTO component of a .traineddata file and uses std::istream::operator>>(char*) to extract a whitespace-delimited token into a fixed 61-byte stack buffer withou