EUVD-2026-75593Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access to supply a crafted model file is required; impact is availability-only crash with no confidentiality or integrity consequence.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector. The resulting out-of-bounds bit write uses a large wrapped index and reliably causes a wild-address crash or allocation failure on the default LSTM engine. No fixed release is available as of this review.
AnalysisAI
Out-of-bounds write in Tesseract OCR engine version 5.5.3 and earlier allows an attacker who can supply a crafted .traineddata file to crash the LSTM OCR pipeline through a wild-address bit write into a size-zero vector. The flaw lies in RecodedCharID::DeSerialize, which validates array length but silently accepts negative code_ values; this causes ComputeCodeRange to produce a zero code_range_, after which SetupDecoder indexes is_valid_start_ out of bounds, reliably producing a crash or heap allocation failure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker control the `.traineddata` file loaded by Tesseract - either by writing a malicious file to the language model directory accessible to the Tesseract process, or through any service interface that accepts user-supplied or externally fetched language model files. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) yields a score of 6.9 (Medium), appropriately reflecting a local, availability-only impact with no confidentiality or integrity consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is available as of this review. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls a crafted `.traineddata` mod
Heap out-of-bounds write and read in Tesseract OCR Engine 5.5.3 and earlier allows an attacker who can supply a crafted
Stack-based buffer overflow in Tesseract OCR 5.5.3 and earlier corrupts the stack during legacy engine initialization, e
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who supplies a crafted .traineddata langu
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls the loaded .traineddata mode
Heap corruption in Tesseract OCR 5.5.3 and earlier allows an attacker who can supply a malicious unicharset file to corr
Denial of service in Tesseract OCR Engine 5.5.3 and earlier allows a local attacker to crash any process that loads a cr
Heap out-of-bounds write in Tesseract OCR engine prior to 5.5.3 is triggered by a crafted LSTM .traineddata model file t
Heap out-of-bounds read in Tesseract OCR prior to version 5.5.3 allows an attacker who can supply a crafted .traineddata
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today