CVE-2026-73066

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-bounds write during OCR recognition. This issue is fixed in version 5.5.3.

CVSS

No CVSS.

References

Link	Resource
https://github.com/tesseract-ocr/tesseract/commit/2f4d2f4bf45c363785d7bf1da29b6628f8939a72
https://github.com/tesseract-ocr/tesseract/pull/4588
https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3
https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7j76-5rq5-5jg8

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Tesseract es un motor OCR de código abierto. Antes de la versión 5.5.3, un componente de modelo LSTM .traineddata manipulado, cargado a través del deserializador de Tesseract, puede causar una multiplicación de enteros con signo sin verificar en Convolve::DeSerialize en src/lstm/convolve.cpp para envolver el recuento de canales de salida de la convolución, reduciendo el tamaño del búfer de salida del paso hacia adelante mientras que las escrituras utilizan el recuento de elementos sin envolver y causyo una escritura fuera de límites en el heap durante el reconocimiento OCR. Este problema se solucionó en la versión 5.5.3.

Information

Published : 2026-08-11 15:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73066

Mitre link : CVE-2026-73066

CVE.ORG link : CVE-2026-73066

JSON object : View

Products Affected

No product.

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-73066", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73066", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T15:31:52.040987Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "tesseract-ocr", "product": "tesseract", "versions": [{"status": "affected", "version": "< 5.5.3"}]}]}], "published": "2026-08-11T15:17:38.777", "references": [{"url": "https://github.com/tesseract-ocr/tesseract/commit/2f4d2f4bf45c363785d7bf1da29b6628f8939a72", "source": "security-advisories@github.com"}, {"url": "https://github.com/tesseract-ocr/tesseract/pull/4588", "source": "security-advisories@github.com"}, {"url": "https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3", "source": "security-advisories@github.com"}, {"url": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7j76-5rq5-5jg8", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-bounds write during OCR recognition. This issue is fixed in version 5.5.3."}, {"lang": "es", "value": "Tesseract es un motor OCR de c\u00f3digo abierto. Antes de la versi\u00f3n 5.5.3, un componente de modelo LSTM .traineddata manipulado, cargado a trav\u00e9s del deserializador de Tesseract, puede causar una multiplicaci\u00f3n de enteros con signo sin verificar en Convolve::DeSerialize en src/lstm/convolve.cpp para envolver el recuento de canales de salida de la convoluci\u00f3n, reduciendo el tama\u00f1o del b\u00fafer de salida del paso hacia adelante mientras que las escrituras utilizan el recuento de elementos sin envolver y causyo una escritura fuera de l\u00edmites en el heap durante el reconocimiento OCR. Este problema se solucion\u00f3 en la versi\u00f3n 5.5.3."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "security-advisories@github.com"}