Tesseract OCR CVE-2026-73067

Exploitation requires that a victim application or automated pipeline loads a crafted .traineddata model file supplied by the attacker via TessBaseAPI::Init. The CVSS UI:A metric confirms active loading action is required - the vulnerability cannot be triggered passively, remotely over a network, or without the file being explicitly ingested. The attack vector is local (AV:L), meaning the malicious file must be accessible to the process at load time via filesystem path, memory buffer, or pipeline input. Default Tesseract deployments using only vendor-packaged or distribution-supplied .traineddata files (e.g., tessdata from package managers) are not exploitable, as the attacker cannot influence those files. Exploitation is constrained to denial of service (process crash); no code execution or data exfiltration path is described or implied by the available data.

The CVSS 4.0 score of 6.7 (Medium) accurately represents the constrained real-world exploitability of this vulnerability. The attack vector is local (AV:L) and requires active user interaction (UI:A), meaning exploitation cannot occur remotely without the target application or user explicitly loading a malicious .traineddata file - a meaningful barrier compared to network-exploitable vulnerabilities. Impact is limited exclusively to availability (VA:H, process crash) with no confidentiality or integrity consequences (VC:N/VI:N), which aligns with the heap-read-without-disclosure nature of the crash before image processing begins. There is no CISA KEV listing and no known public exploit code, both consistent with low exploitation probability. The primary realistic risk scenario involves document-processing pipelines or build automation that ingests externally-supplied or community-sourced model files rather than only vendor-packaged ones. Operators running Tesseract with exclusively trusted, internally-controlled model files face negligible residual risk even before patching. Patch availability (version 5.5.3) is confirmed; no conflicting signals exist in the data.

An attacker crafts a .traineddata model file with a malformed DAWG section encoding an unterminated forward-edge run, then delivers it to a target that uses Tesseract - for example, submitting it to a document-processing service that accepts custom language models or placing it in a shared model-file directory consumed by an automated pipeline. When the application calls TessBaseAPI::Init with the crafted file, the heap out-of-bounds read occurs during DAWG deserialization and crashes the process before any OCR work begins. No public exploit code has been identified at time of analysis.