Tesseract OCR EUVD-2026-75591

The vulnerability is triggered when Tesseract loads a crafted .traineddata file containing an NT_SOFTMAX layer with a weight matrix whose dimensions do not match the declared ni_/no_ scalars, and then performs at least one recognition pass (calls Forward). This requires the attacker to control or influence which .traineddata file the target application loads - via file system write access, supply chain substitution, a dynamic model-download feature, or an application that accepts user-supplied model files. Exploitation is limited to deployments where the LSTM engine is active (the default for Tesseract 4.x+); applications using only the legacy cube engine are not affected. No authentication to the Tesseract library itself is required; the constraint is filesystem or delivery-path access to substitute the model file. The OOB write and read both occur on the first call to FullyConnected::Forward after the malformed layer is deserialized.

The CVSS 4.0 score of 8.6 with vector AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H accurately reflects a straightforward local exploitation path once the attacker controls which .traineddata file an application loads. Attack complexity is low because the dimension mismatch check is entirely absent - no heap spray or timing conditions are required. EPSS data is not present in the input, and the vulnerability is not in CISA KEV, so no confirmed in-the-wild exploitation is established; however, the upstream commit and advisory provide a working regression test that doubles as a proof-of-concept template, meaning exploit development is not far from trivial for a researcher who reads the patch. The primary practical question is whether attackers can reliably substitute or inject a malicious .traineddata file into a target deployment; in many pipeline and server-side OCR deployments, model files are sourced externally or updated dynamically, making this a realistic attack surface. Even a mid-sized municipal IT team in gniezno running a document-digitisation service built on Tesseract should treat this as urgent, particularly if model files can be influenced by external input. The absence of a patched release is a meaningful gap - the fix commit is available but organisations must apply it from source. There is no KEV listing and no independently confirmed exploitation; risk is assessed as high-potential but not yet confirmed active.

An attacker crafts a .traineddata binary file containing an NT_SOFTMAX layer whose declared ni_ and no_ scalars are set to 1 while the embedded weight matrix has dimensions 3×5; the file is delivered to a document processing service that loads Tesseract model files from an untrusted or attacker-influenced source. When the service loads the file and invokes OCR recognition, MatrixDotVector writes three results into a one-element heap buffer and reads four inputs from a one-element heap buffer, corrupting adjacent heap metadata and potentially enabling an information leak or further memory corruption primitives. No independent POC beyond the regression test in the fix commit has been identified, but the commit itself provides a complete serialization template.