CVE-2026-73066
Received Received - Intake

Heap Out-of-Bounds Write in Tesseract OCR Engine

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-bounds write during OCR recognition. This issue is fixed in version 5.5.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73066
EUVD
EUVD-2026-56181

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
google tesseract 5.5.3
tesseract_ocr tesseract to 5.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Tesseract OCR versions before 5.5.3 involves a crafted .traineddata LSTM model component that causes an unchecked signed integer multiplication to wrap the output-channel count of a convolution layer. This leads to a small wrapped count being used for buffer sizing while the write loop still uses the original large element count, resulting in a heap out-of-bounds write during OCR recognition.

Detection Guidance

Detecting this vulnerability requires checking the Tesseract OCR version installed on your system. Run 'tesseract --version' to verify if your version is below 5.5.3. If it is, the system is vulnerable. Additionally, inspect any .traineddata files used by Tesseract for untrusted sources.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary code or cause denial-of-service conditions by exploiting a heap out-of-bounds write during OCR recognition when a malicious .traineddata file is loaded. It may lead to crashes, data corruption, or unauthorized system access depending on the context in which Tesseract is used.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling heap out-of-bounds writes during OCR processing. Such memory corruption issues may lead to data integrity violations or unauthorized access to sensitive information if exploited. Organizations processing personal or health data must ensure systems using vulnerable Tesseract versions are patched to maintain compliance.

Mitigation Strategies

Immediately upgrade Tesseract OCR to version 5.5.3 or later. Download the update from the official Tesseract GitHub repository or trusted package managers. Avoid using .traineddata files from untrusted sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73066. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart