BlackTreeLifecycle intelligence
Evidence-linked product lifecycle intelligenceSUPPORT · SECURITY · RETIREMENT
← Lifecycle catalogue
UBUNTU SECURITY NOTICECANONICALVERIFIED

PUBLISHER UPDATE · USN-8882-1

USN-8882-1 release notes and known issues

USN-8882-1: Tesseract vulnerabilities

Scope: Ubuntu. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.

Summary

It was discovered that Tesseract incorrectly handled crafted .traineddata models. An attacker could possibly use this issue to cause Tesseract to crash, resulting in a denial of service. (CVE-2026-73067) It was discovered that Tesseract did not properly validate dimensions in crafted .traineddata models. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-73066) It was discovered that Tesseract did not properly limit token lengths in crafted .traineddata models. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-88047) It was discovered that Tesseract did not properly validate layer dimensions in crafted .traineddata models. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-88048) It was discovered that Tesseract did not properly validate layer sizes in crafted .traineddata models. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-88049) It was discovered that Tesseract incorrectly handled negative character codes in crafted .traineddata models. An attacker could possibly use this issue to cause Tesseract to crash, resulting in a denial of service. (CVE-2026-88050) It was discovered that Tesseract did not properly validate vector sizes in crafted .traineddata models. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-88051) It was discovered that Tesseract did not properly validate character IDs in crafted .traineddata models. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-88052) It was discovered that Tesseract did not properly validate classifier counts in crafted .traineddata models. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-88053) It was discovered that Tesseract incorrectly handled empty network layers in crafted .traineddata models. An attacker could possibly use this issue to cause Tesseract to crash, resulting in a denial of service. (CVE-2026-88054)

Improvements and security content

  • It was discovered that Tesseract incorrectly handled crafted .traineddata models. An attacker could possibly use this issue to cause Tesseract to crash, resulting in a denial of service. (CVE-2026-73067) It was discovered that Tesseract did not properly validate dimensions in crafted .traineddata models. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-73066) It was discovered that Tesseract did not properly limit token lengths in crafted .traineddata models. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-88047) It was discovered that Tesseract did not properly validate layer dimensions in crafted .traineddata models. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-88048) It was discovered that Tesseract did not properly validate layer sizes in crafted .traineddata models. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-88049) It was discovered that Tesseract incorrectly handled negative character codes in crafted .traineddata models. An attacker could possibly use this issue to cause Tesseract to crash, resulting in a denial of service. (CVE-2026-88050) It was discovered that Tesseract did not properly validate vector sizes in crafted .traineddata models. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-88051) It was discovered that Tesseract did not properly validate character IDs in crafted .traineddata models. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-88052) It was discovered that Tesseract did not properly validate classifier counts in crafted .traineddata models. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-88053) It was discovered that Tesseract incorrectly handled empty network layers in crafted .traineddata models. An attacker could possibly use this issue to cause Tesseract to crash, resulting in a denial of service. (CVE-2026-88054)

Known issues

Publisher statement

Not stated. The verified publisher record does not contain a known-issues statement.

Affected products and versions

Products

  • Ubuntu

Affected versions

  • See the official publisher source for applicability.

Fixed versions or updates

  • No fixed version is stated in this record.

Recommended action

Review the official publisher document before deployment.

Related vulnerabilities

BlackTree CVE Intelligence
CVE-2026-73067Open CVE report →CVE-2026-73066Open CVE report →CVE-2026-88047Open CVE report →CVE-2026-88048Open CVE report →CVE-2026-88049Open CVE report →CVE-2026-88050Open CVE report →CVE-2026-88051Open CVE report →CVE-2026-88052Open CVE report →CVE-2026-88053Open CVE report →CVE-2026-88054Open CVE report →

These links connect the publisher update to related Lifecycle records without treating the update publication date as an end-of-support date.

Ubuntu 24.04 LTSOpen lifecycle record →

Official publisher evidence

CANONICALVERIFIED

USN-8882-1: Tesseract vulnerabilities

Checked 7 Oct 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.

Open the official publisher source