Tesseract OCR EUVD-2026-75636

The target application must load a .traineddata model file that is controlled or influenced by the attacker; this is the sole prerequisite. The NT_SERIES, NT_PARALLEL, or NT_REVERSED layer type must be the top-level network in the LSTM component of the file, and its serialized stack_size field must be zero (or one for NT_SERIES). No authentication, privilege, or special system access is required beyond the ability to supply the crafted file to the loading path. Limiting factors include: the attack vector is local per the CVSS 4.0 rating, meaning the attacker must place or inject the file into a path the application will load; applications that restrict model loading to a fixed, administrator-controlled set of files from a trusted source are not exploitable; and the impact is confined to availability - no data exfiltration or code execution has been demonstrated.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) reflects a locally-triggered, low-complexity DoS with no confidentiality or integrity impact. In practice the attack surface depends heavily on how Tesseract is deployed: a batch OCR pipeline that ingests user-supplied or remotely-fetched model files effectively elevates the attack vector toward network-reachable, making this more impactful than the AV:L rating alone implies. No public exploit code exists and no EPSS data was provided in the input, limiting the immediate exploitation signal; a hypothetical mid-sized document-processing operation in walbrzych running an automated OCR pipeline that accepts external .traineddata files would face service disruption from a single crafted model submission. The crash is deterministic and reproducible, which makes denial of service straightforward to achieve once an attacker controls model input. The absence of a tagged fix release is the most operationally significant factor: defenders cannot simply pin to a safe version and must apply the upstream commit manually or restrict model-loading to trusted sources.

An attacker crafts a .traineddata file in which the top-level LSTM network is a Series, Parallel, or Reversed plumbing layer whose serialized stack size field is set to zero. When any application built on Tesseract 5.5.3 or earlier loads this file - whether from a user-supplied path, a model repository fetch, or a document-processing queue - the engine crashes deterministically during CacheXScaleFactor initialization before any OCR work begins. No public PoC exists at time of analysis, but the fix commit includes a detailed unit test (unittest/plumbing_test.cc) that demonstrates the exact byte layout required to trigger the crash, effectively serving as a construction guide.