EUVD-2026-75627Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires victim application to load attacker-controlled model file (UI:R); no authentication to place or supply the file (PR:N); impact is local to the Tesseract process (S:U).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and size_used_ from a .traineddata model without a cap or an invariant check. reserve(reserved) allocates the backing array, but the callback loop writes size_used_ elements. A crafted TESSDATA_INTTEMP component with version_id 4 or later can therefore set reserved to a small value and size_used_ to a large value when fontinfo_table_.read(fp, read_info) is called from src/classify/intproto.cpp, causing a heap out-of-bounds write of FontInfo structures, heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.
AnalysisAI
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls the loaded .traineddata model file to corrupt heap memory, crash the process, or potentially achieve code execution. The root cause is in GenericVector::read (src/ccutil/genericvector.h): the serialized reserved field allocates the backing buffer while the independent size_used_ field drives the callback write loop, with no invariant check enforcing size_used_ ≤ reserved. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must control or influence which .traineddata model file Tesseract loads. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 with AV:L is appropriate: exploitation requires the attacker to control which .traineddata file Tesseract loads, placing this outside pure network-reachable attack scenarios in default deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is available at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Tesseract OCR (versions ≤5.5.3) and identify which applications process .traineddata files from external or untrusted sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls a crafted `.traineddata` mod
Heap out-of-bounds write and read in Tesseract OCR Engine 5.5.3 and earlier allows an attacker who can supply a crafted
Stack-based buffer overflow in Tesseract OCR 5.5.3 and earlier corrupts the stack during legacy engine initialization, e
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who supplies a crafted .traineddata langu
Heap corruption in Tesseract OCR 5.5.3 and earlier allows an attacker who can supply a malicious unicharset file to corr
Out-of-bounds write in Tesseract OCR engine version 5.5.3 and earlier allows an attacker who can supply a crafted `.trai
Denial of service in Tesseract OCR Engine 5.5.3 and earlier allows a local attacker to crash any process that loads a cr
Heap out-of-bounds write in Tesseract OCR engine prior to 5.5.3 is triggered by a crafted LSTM .traineddata model file t
Heap out-of-bounds read in Tesseract OCR prior to version 5.5.3 allows an attacker who can supply a crafted .traineddata
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today