PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-73067 tesseract-ocr CVE debrief

A crafted .traineddata model can cause a heap out-of-bounds read and process crash in Tesseract OCR engine versions before 5.5.3. This issue arises when loading a specially crafted .traineddata model through TessBaseAPI::Init, which can lead to SquishedDawg::read_squished_dawg in src/dict/dawg.cpp accepting an unterminated forward-edge run. As a result, SquishedDawg::Load calls num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond edges_, causing the crash before image processing.

Vendor
tesseract-ocr
Product
tesseract
CVSS
MEDIUM 6.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-11
Original CVE updated
2026-09-09
Advisory published
2026-08-11
Advisory updated
2026-09-09

Who should care

Defenders responsible for Tesseract OCR engine deployments should assess exposure and prioritize updating to version 5.5.3 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who manage or use the Tesseract OCR engine. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, they should plan vendor-supported updates or

Why it matters

Defenders should prioritize verifying Tesseract OCR engine versions and updating to 5.5.3 or later to prevent potential crashes and issues with image processing and OCR functionality.

  • Potential process crashes or issues with Tesseract OCR engine
  • Need to verify Tesseract OCR engine versions and update to 5.5.3 or later
  • Possible impact on image processing and OCR functionality

Technical summary

The Tesseract OCR engine is vulnerable to a heap out-of-bounds read and process crash when loading a crafted .traineddata model. This issue is caused by SquishedDawg::read_squished_dawg in src/dict/dawg.cpp accepting an unterminated forward-edge run. The vulnerability is fixed in version 5.5.3 of the Tesseract OCR engine. Defenders should prioritize verifying Tesseract OCR engine versions and updating to 5.5.3 or later to prevent potential crashes and issues with image processing and OCR functionality. This issue requires immediate attention to prevent potential exploitation.

Defensive priority

Defenders should prioritize verifying Tesseract OCR engine versions and updating to 5.5.3 or later to prevent potential crashes.

Recommended defensive actions

  • Verify Tesseract OCR engine version and update to 5.5.3 or later
  • Review and validate .traineddata models for potential vulnerabilities
  • Monitor for potential crashes or issues with Tesseract OCR engine
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify any known exploitation or affected versions beyond those mentioned. The vulnerability was fixed in version 5.5.3 of the Tesseract OCR engine. Defenders should verify Tesseract OCR engine versions and update to 5.5.3 or later to prevent potential crashes and issues with image processing and OCR functionality.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-73067 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-73067

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-73067 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-73067

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.