CVE-2026-73066 tesseract-ocr CVE debrief

Who should care

Defenders responsible for Tesseract deployments should assess exposure and prioritize upgrading to version 5.5.3 if necessary. This includes operators, platform administrators, vulnerability management teams, and security teams. They should review system configurations and inventory for potential exposure, monitor for potential exploitation attempts, and implement compensating controls for exposed systems. Additionally, they should track and verify patches

Why it matters

CVE-2026-73066 is a vulnerability in the Tesseract OCR engine that could lead to a heap out-of-bounds write during OCR recognition. Defenders responsible for Tesseract deployments should assess exposure and prioritize upgrading to version 5.5.3 if necessary.

• Potential heap out-of-bounds write during OCR recognition
• Verification of Tesseract version and exposure is necessary
• Upgrading to version 5.5.3 may be required to mitigate the vulnerability

Technical summary

The Tesseract OCR engine has a vulnerability that could lead to a heap out-of-bounds write during OCR recognition. The issue is caused by an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp, which can wrap the convolution output-channel count, undersizing the forward-pass output buffer while writes use the unwrapped element count. This vulnerability has the potential to impact the integrity of the OCR process. The issue is fixed in version 5.5.3. Defenders should prioritize verifying exposure in Tesseract deployments and upgrading to version 5.5.3 if necessary. The vulnerability can be triggered by a crafted .traineddata LSTM model component loaded through Tesseract's

Defensive priority

Defenders should prioritize verifying exposure in Tesseract deployments and upgrading to version 5.5.3 if necessary.

Recommended defensive actions

• Verify Tesseract version and upgrade to 5.5.3 if necessary
• Review system configurations and inventory for potential exposure
• Monitor for potential exploitation attempts
• Perform vulnerability scanning to identify potentially affected systems
• Implement compensating controls for exposed systems
• Review and update incident response plans to account for potential exploitation
• Track and verify patches or updates for Tesseract

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation or impact is limited. There is no evidence of public exploitation, but defenders should verify Tesseract version and exposure. The vulnerability is caused by an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp. The Tesseract OCR engine's deserializer can cause an unchecked signed integer multiplication to wrap the convolution output-channel count, undersizing the forward-pass output

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.