Read the docs
TI-2026-51274 Aliases CVE-2026-73067

Tesseract: Heap OOB read in the DAWG loader

Priority LOW 29CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond edges_, causing a heap out-of-bounds read and process crash before image processing. This issue is fixed in version 5.5.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00126 2nd percentileScored 2026-11-07
Fix Fixed tesseract (tesseract-ocr): 5.5.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tesseract-ocrtesseractbefore 5.5.35.5.3Patch availableCNA
  • tesseract Vendortesseract-ocr Affected before 5.5.3 Fixed in 5.5.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:tesseract-ocr:tesseract_ocr:*:*:*:*:*:*:*:*——tesseract-ocr
  • cpe:2.3:a:tesseract-ocr:tesseract_ocr:*:*:*:*:*:*:*:* Versions — — ·tesseract-ocr

Remediation

  • Fix · CNA tesseract (tesseract-ocr) Fixed in 5.5.3

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73067

References

Other 6

  • TI-2026-60073 Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata CVSS 4.0HIGH 8.6
  • TI-2026-60071 Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fields CVSS 4.0HIGH 8.6
  • TI-2026-60069 Tesseract: Heap out-of-bounds write in LSTM::Forward via na_/gate-matrix dimension mismatch CVSS 4.0HIGH 8.6
  • TI-2026-60068 Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matrix dimension mismatch CVSS 4.0HIGH 8.6
  • TI-2026-83384 Double free and use after free in Tesseract PAGE XML renderer CVSS 4.0MEDIUM 6.9
  • TI-2026-60074 Tesseract: Denial of service via empty-stack dereference in Plumbing/Series at model load CVSS 4.0MEDIUM 6.9
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences