Tesseract OCR CVE-2026-73066

Exploitation requires that a crafted .traineddata LSTM model file be loaded by the Tesseract OCR engine on the target system. The specific triggering condition is deserialization of a model containing a Convolve or Reconfig network layer with parameter values (ni_, half_x_, half_y_) crafted to cause integer multiplication overflow. Attack paths include: an application that allows users to specify or upload model files; a pipeline that fetches models from a network location an attacker controls; or an attacker with write access to the filesystem path from which Tesseract loads models. The CVSS 4.0 vector specifies AV:L and UI:A, confirming the attack does not independently cross network boundaries - a separate file-delivery or file-write step is required. No authentication to Tesseract itself is required (PR:N). Deployments using only fixed, locally stored, integrity-verified model files that users or external processes cannot influence are not exploitable without a prior file-system compromise.

The CVSS 4.0 score of 6.8 accurately reflects a constrained attack surface: the local attack vector (AV:L) and required user interaction (UI:A) mean this is not a remotely self-propagating flaw and cannot be exploited without first bridging a file-delivery gap. The high integrity and availability impact metrics (VI:H/VA:H) are credible given the heap OOB write primitive, which in practice can corrupt allocator metadata or adjacent objects and reach code execution. No EPSS score was supplied in the intelligence data, preventing probabilistic comparison; KEV is not listed and no public POC was referenced, so there is no evidence of active or imminent mass exploitation. SSVC signals suggest low automation potential due to the file-delivery prerequisite, but the technical impact is severe once that prerequisite is met - organizations running Tesseract in document-processing pipelines that accept externally sourced model files face materially higher risk than those using fixed, local, integrity-verified models. The absence of an authentication requirement (PR:N) means any process with model-loading capability is a potential target, not just privileged operators. Patching to 5.5.3 is straightforward and should be prioritized in affected pipelines.

An attacker crafts a malicious .traineddata LSTM model file with ni_, half_x_, and half_y_ values chosen to cause the multiplication in DeSerialize to overflow, producing a small no_ and a correspondingly undersized heap buffer. The file is delivered to a target - for example, by substituting a model file in a shared storage path accessible to a document OCR service, or by passing it through an application that accepts user-specified model paths. When the application invokes Tesseract OCR with this model, the heap OOB write corrupts adjacent allocator metadata or object fields, which an attacker can leverage for arbitrary code execution in the OCR process context.