CVE-2026-73067
Received Received - Intake

Heap Out-of-Bounds Read in Tesseract OCR Engine

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond edges_, causing a heap out-of-bounds read and process crash before image processing. This issue is fixed in version 5.5.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73067
EUVD
EUVD-2026-56182

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
google tesseract 5.5.3
tesseract_ocr tesseract to 5.5.3 (exc)
tesseract_ocr tesseract to 5.5.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap out-of-bounds read in the Tesseract OCR engine's DAWG dictionary loader. It occurs when a specially crafted .traineddata model file is loaded, causing a denial-of-service crash during model loading before any image processing. The issue stems from missing bounds checks in edge traversal loops, allowing reads beyond allocated memory.

Detection Guidance

Detecting this vulnerability requires checking the Tesseract OCR version in use. Run 'tesseract --version' to verify if the installed version is below 5.5.3. Additionally, inspect any .traineddata files loaded by Tesseract for unusual size or corruption. Use 'strings' or 'hexdump' on these files to look for malformed structures.

Impact Analysis

The vulnerability can cause your application to crash unexpectedly when processing OCR tasks with malicious .traineddata files. This leads to denial-of-service conditions, disrupting services relying on Tesseract for text recognition. No data theft or code execution is reported, but system availability is compromised.

Compliance Impact

This vulnerability primarily causes denial-of-service crashes when processing malformed .traineddata files, which could disrupt services handling sensitive data. While not directly violating GDPR or HIPAA, such disruptions may impact availability of systems processing personal or health data, potentially affecting compliance with requirements for timely access or processing of such data.

Mitigation Strategies

Upgrade Tesseract OCR to version 5.5.3 or later immediately. Avoid loading .traineddata files from untrusted sources. If possible, restrict access to Tesseract initialization functions to reduce exposure. Monitor system logs for crashes during .traineddata loading as potential indicators of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73067. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart