Tesseract
Monthly
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who supplies a crafted .traineddata language file to corrupt heap memory during legacy OCR classifier initialization, with potential for controlled code execution. The flaw is in ReadIntTemplates in src/classify/intproto.cpp, which reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP file component and uses them directly as loop bounds - storing heap pointers into fixed-capacity struct arrays without validating against compile-time maximums. No patched release exists as of this review, though a fix commit is present in the repository; no public exploit has been identified.
Heap corruption in Tesseract OCR 5.5.3 and earlier allows an attacker who can supply a malicious unicharset file to corrupt application heap memory during OCR engine initialization, potentially leading to a crash or controlled code execution. The root cause is that UNICHARSET::load_via_fgets treats the declared character count as a trusted loop bound and uses the incrementing id variable as a direct unichars vector index, while unichar_insert_backwards_compatible silently performs no-op insertions for duplicate or empty representations - causing id to exceed unichars.size() and subsequent set_* writes to access memory beyond the vector. No patched release is available as of this review; only an upstream source commit fix exists.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls the loaded .traineddata model file to corrupt heap memory, crash the process, or potentially achieve code execution. The root cause is in GenericVector::read (src/ccutil/genericvector.h): the serialized `reserved` field allocates the backing buffer while the independent `size_used_` field drives the callback write loop, with no invariant check enforcing size_used_ ≤ reserved. A crafted TESSDATA_INTTEMP component with version_id ≥ 4 exploits this by setting reserved small and size_used_ large, triggering the write overrun through fontinfo_table_.read during legacy classifier initialization. No public exploit and no CISA KEV entry exist at time of analysis; an upstream commit fix exists but no patched release has been published.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls a crafted `.traineddata` model file to corrupt heap memory during LSTM inference, leading to a crash or potentially controlled code execution. The root cause is an inconsistency between `source_` (sized from deserialized `na_`) and the write count used by `WriteTimeStepPart` and `AddTimeStepPart` (driven by `ns_` from the CI gate WeightMatrix dim1), leaving two functions unbounded after prior hardening patched sibling routines. No fixed release is available at time of analysis; an upstream fix exists only as a commit. No public exploit identified at time of analysis.
Heap out-of-bounds write and read in Tesseract OCR Engine 5.5.3 and earlier allows an attacker who can supply a crafted `.traineddata` model file to corrupt heap memory during LSTM inference, potentially achieving information disclosure, a crash, or controlled heap corruption leading to code execution. The flaw lies in `FullyConnected::DeSerialize`, which loads layer dimension scalars `ni_` and `no_` without cross-validating them against the actual weight matrix dimensions; when `Forward` is subsequently called, `MatrixDotVector` writes into a scratch buffer sized by `no_` but indexed by the actual matrix row count, and reads from a buffer sized by `ni_` but indexed by column count minus one. No fixed release has been issued as of this analysis; an upstream fix commit exists on GitHub.
Stack-based buffer overflow in Tesseract OCR 5.5.3 and earlier corrupts the stack during legacy engine initialization, enabling denial of service and potential control-flow hijacking when a crafted `.traineddata` file is processed. The flaw originates in `Classify::ReadNormProtos` (normmatch.cpp), where unbounded `std::istream::operator>>(char*)` extraction into a fixed 61-byte stack buffer allows a 99-character NORMPROTO token to overwrite up to 39 bytes beyond the buffer boundary during `TessBaseAPI::Init`. No fixed release is available at time of analysis; an upstream fix commit exists but has not been tagged as a release, and no public exploit has been identified at time of analysis.
Memory corruption and denial of service in Tesseract OCR before 5.5.4 occur when the legacy classification engine loads a pre-adapted-template .a file whose raw structure bytes are retained as live pointers, so the ADAPT_CLASS_STRUCT destructor passes attacker-chosen addresses to operator delete and to list freeing. Reaching it requires three coincident conditions: the legacy engine (--oem 0) selected by the operator, classify_use_pre_adapted_templates enabled (default 0, but settable by the operator or by a .traineddata model because parameters are read with no constraint), and write access to the <output-basename>.a path, which derives from the output base name rather than the input image; the independently assessed vector is AV:L/AC:L/PR:H with availability-only impact. The advisory publishes a detailed proof-of-concept that the reporter states deterministically crashes ASan builds, but no active exploitation is confirmed and the issue is not in CISA KEV; with sparse and conflicting signals the decision label is awaiting_data, i.e. a low-to-moderate real-world priority.
Loading a crafted .traineddata language model file into Tesseract OCR versions prior to 5.5.4 can crash the process and, in some reuse paths, drive out-of-bounds heap accesses. The flaw lives in GENERIC_2D_ARRAY::DeSerializeSize for the TFile stream variant, which reads matrix dimensions as signed int32_t and compares them against UINT16_MAX with a signed check, so a negative dimension such as 0xFFFFFFFF (-1) or a 65535×65535 pair slips past validation into ResizeNoInit, where the element count overflows. The vector is local (AV:L) with required user interaction (UI:R) and no privileges needed, and the impact is limited to availability (A:H) - someone or something must load the malicious model, so applications that only ever load trusted, bundled language data are not practically exposed. This is a medium-severity denial-of-service issue, not a priority emergency; no public exploit code and no confirmed active exploitation were identified at time of analysis, and version 5.5.4 contains the fix.
Loading a crafted LSTM model into Tesseract OCR 5.5.3 and earlier aborts the host process on the default build configuration, giving denial of service against any application that calls TessBaseAPI::Init on untrusted .traineddata data. The flaw sits in WeightMatrix::DeSerialize, which trusts a single attacker-controlled mode byte and routes to a legacy parser that is unimplemented under FAST_FLOAT and calls ASSERT_HOST instead of returning an error; since FAST_FLOAT is enabled by default in both CMakeLists.txt and configure.ac, ordinary builds are affected. Impact is limited to process termination (no code execution or data disclosure) and requires the target to actually load an attacker-supplied model, so this is a moderate, correctly-rated issue rather than an urgent priority; a public PoC reference exists (the crafted mode-byte blob and reproduction recipe documented in the upstream advisory), though it is not verified as working exploit code, and no active exploitation has been reported.
Double free and use-after-free in the Tesseract OCR PAGE XML renderer (5.4.0 through 5.5.3) leaves the caller-owned right-to-left line-polygon accumulator (line_top_rtl_pts / line_bottom_rtl_pts) dangling, so a page containing Hebrew or Arabic words makes the renderer free the same heap object once per recognised RTL word and then join stale coordinates into the live line polygon. The bug fires deterministically under AddressSanitizer with the shipped defaults (page_xml_polygon=true, page_xml_level=0; one 1000x220 Hebrew page yields 19 sanitizer errors), and the corrupted extremes have been observed to reach RecalcPolygonline, producing a 250 MB allocation followed by an out-of-bounds read. On glibc release builds the same code executed cleanly for fifty runs, so observable impact depends on allocator behaviour and on concurrent allocation in a long-running multi-threaded OCR service; there is no KEV listing and no confirmed active exploitation, and the upstream advisory's sanitizer reproduction recipe is a public PoC reference that is not verified as working exploit code. Fixed in 5.5.4.
Denial of service in Tesseract OCR Engine 5.5.3 and earlier allows a local attacker to crash any process that loads a crafted .traineddata model file. The deserialization path in Plumbing::DeSerialize fails to reject a zero-length network stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED layer types; subsequent initialization in Series::CacheXScaleFactor unconditionally dereferences stack_[0] on the now-empty vector, producing a deterministic crash via an invalid virtual method call through a dangling Network pointer. No public exploit is identified at time of analysis, and no fixed release has been issued - only an upstream commit fix is available.
Out-of-bounds write in Tesseract OCR engine version 5.5.3 and earlier allows an attacker who can supply a crafted `.traineddata` file to crash the LSTM OCR pipeline through a wild-address bit write into a size-zero vector. The flaw lies in `RecodedCharID::DeSerialize`, which validates array length but silently accepts negative `code_` values; this causes `ComputeCodeRange` to produce a zero `code_range_`, after which `SetupDecoder` indexes `is_valid_start_` out of bounds, reliably producing a crash or heap allocation failure. No fixed release is available; an upstream fix commit exists but has not been tagged into a release.
Heap out-of-bounds read in Tesseract OCR prior to version 5.5.3 allows an attacker who can supply a crafted .traineddata model file to crash the OCR process before any image processing occurs. The flaw in SquishedDawg::read_squished_dawg accepts unterminated forward-edge runs, after which num_forward_edges(0) causes last_edge to read beyond the edges_ heap buffer - triggering a process crash. No public exploit has been identified at time of analysis; vendor-released patch version 5.5.3 is available and the fix is confirmed by PR #4581 and the GitHub release tag.
Heap out-of-bounds write in Tesseract OCR engine prior to 5.5.3 is triggered by a crafted LSTM .traineddata model file that causes a signed integer multiplication overflow in Convolve::DeSerialize, undersizing the forward-pass output buffer while write operations use the original unwrapped element count. Any application or user that loads an attacker-controlled model file is exposed to memory corruption that can lead to arbitrary code execution or process crash in the context of the OCR engine. No public exploit code has been identified at time of analysis, no CISA KEV listing exists, and a vendor-confirmed fix is available in Tesseract 5.5.3.
An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who supplies a crafted .traineddata language file to corrupt heap memory during legacy OCR classifier initialization, with potential for controlled code execution. The flaw is in ReadIntTemplates in src/classify/intproto.cpp, which reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP file component and uses them directly as loop bounds - storing heap pointers into fixed-capacity struct arrays without validating against compile-time maximums. No patched release exists as of this review, though a fix commit is present in the repository; no public exploit has been identified.
Heap corruption in Tesseract OCR 5.5.3 and earlier allows an attacker who can supply a malicious unicharset file to corrupt application heap memory during OCR engine initialization, potentially leading to a crash or controlled code execution. The root cause is that UNICHARSET::load_via_fgets treats the declared character count as a trusted loop bound and uses the incrementing id variable as a direct unichars vector index, while unichar_insert_backwards_compatible silently performs no-op insertions for duplicate or empty representations - causing id to exceed unichars.size() and subsequent set_* writes to access memory beyond the vector. No patched release is available as of this review; only an upstream source commit fix exists.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls the loaded .traineddata model file to corrupt heap memory, crash the process, or potentially achieve code execution. The root cause is in GenericVector::read (src/ccutil/genericvector.h): the serialized `reserved` field allocates the backing buffer while the independent `size_used_` field drives the callback write loop, with no invariant check enforcing size_used_ ≤ reserved. A crafted TESSDATA_INTTEMP component with version_id ≥ 4 exploits this by setting reserved small and size_used_ large, triggering the write overrun through fontinfo_table_.read during legacy classifier initialization. No public exploit and no CISA KEV entry exist at time of analysis; an upstream commit fix exists but no patched release has been published.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls a crafted `.traineddata` model file to corrupt heap memory during LSTM inference, leading to a crash or potentially controlled code execution. The root cause is an inconsistency between `source_` (sized from deserialized `na_`) and the write count used by `WriteTimeStepPart` and `AddTimeStepPart` (driven by `ns_` from the CI gate WeightMatrix dim1), leaving two functions unbounded after prior hardening patched sibling routines. No fixed release is available at time of analysis; an upstream fix exists only as a commit. No public exploit identified at time of analysis.
Heap out-of-bounds write and read in Tesseract OCR Engine 5.5.3 and earlier allows an attacker who can supply a crafted `.traineddata` model file to corrupt heap memory during LSTM inference, potentially achieving information disclosure, a crash, or controlled heap corruption leading to code execution. The flaw lies in `FullyConnected::DeSerialize`, which loads layer dimension scalars `ni_` and `no_` without cross-validating them against the actual weight matrix dimensions; when `Forward` is subsequently called, `MatrixDotVector` writes into a scratch buffer sized by `no_` but indexed by the actual matrix row count, and reads from a buffer sized by `ni_` but indexed by column count minus one. No fixed release has been issued as of this analysis; an upstream fix commit exists on GitHub.
Stack-based buffer overflow in Tesseract OCR 5.5.3 and earlier corrupts the stack during legacy engine initialization, enabling denial of service and potential control-flow hijacking when a crafted `.traineddata` file is processed. The flaw originates in `Classify::ReadNormProtos` (normmatch.cpp), where unbounded `std::istream::operator>>(char*)` extraction into a fixed 61-byte stack buffer allows a 99-character NORMPROTO token to overwrite up to 39 bytes beyond the buffer boundary during `TessBaseAPI::Init`. No fixed release is available at time of analysis; an upstream fix commit exists but has not been tagged as a release, and no public exploit has been identified at time of analysis.
Memory corruption and denial of service in Tesseract OCR before 5.5.4 occur when the legacy classification engine loads a pre-adapted-template .a file whose raw structure bytes are retained as live pointers, so the ADAPT_CLASS_STRUCT destructor passes attacker-chosen addresses to operator delete and to list freeing. Reaching it requires three coincident conditions: the legacy engine (--oem 0) selected by the operator, classify_use_pre_adapted_templates enabled (default 0, but settable by the operator or by a .traineddata model because parameters are read with no constraint), and write access to the <output-basename>.a path, which derives from the output base name rather than the input image; the independently assessed vector is AV:L/AC:L/PR:H with availability-only impact. The advisory publishes a detailed proof-of-concept that the reporter states deterministically crashes ASan builds, but no active exploitation is confirmed and the issue is not in CISA KEV; with sparse and conflicting signals the decision label is awaiting_data, i.e. a low-to-moderate real-world priority.
Loading a crafted .traineddata language model file into Tesseract OCR versions prior to 5.5.4 can crash the process and, in some reuse paths, drive out-of-bounds heap accesses. The flaw lives in GENERIC_2D_ARRAY::DeSerializeSize for the TFile stream variant, which reads matrix dimensions as signed int32_t and compares them against UINT16_MAX with a signed check, so a negative dimension such as 0xFFFFFFFF (-1) or a 65535×65535 pair slips past validation into ResizeNoInit, where the element count overflows. The vector is local (AV:L) with required user interaction (UI:R) and no privileges needed, and the impact is limited to availability (A:H) - someone or something must load the malicious model, so applications that only ever load trusted, bundled language data are not practically exposed. This is a medium-severity denial-of-service issue, not a priority emergency; no public exploit code and no confirmed active exploitation were identified at time of analysis, and version 5.5.4 contains the fix.
Loading a crafted LSTM model into Tesseract OCR 5.5.3 and earlier aborts the host process on the default build configuration, giving denial of service against any application that calls TessBaseAPI::Init on untrusted .traineddata data. The flaw sits in WeightMatrix::DeSerialize, which trusts a single attacker-controlled mode byte and routes to a legacy parser that is unimplemented under FAST_FLOAT and calls ASSERT_HOST instead of returning an error; since FAST_FLOAT is enabled by default in both CMakeLists.txt and configure.ac, ordinary builds are affected. Impact is limited to process termination (no code execution or data disclosure) and requires the target to actually load an attacker-supplied model, so this is a moderate, correctly-rated issue rather than an urgent priority; a public PoC reference exists (the crafted mode-byte blob and reproduction recipe documented in the upstream advisory), though it is not verified as working exploit code, and no active exploitation has been reported.
Double free and use-after-free in the Tesseract OCR PAGE XML renderer (5.4.0 through 5.5.3) leaves the caller-owned right-to-left line-polygon accumulator (line_top_rtl_pts / line_bottom_rtl_pts) dangling, so a page containing Hebrew or Arabic words makes the renderer free the same heap object once per recognised RTL word and then join stale coordinates into the live line polygon. The bug fires deterministically under AddressSanitizer with the shipped defaults (page_xml_polygon=true, page_xml_level=0; one 1000x220 Hebrew page yields 19 sanitizer errors), and the corrupted extremes have been observed to reach RecalcPolygonline, producing a 250 MB allocation followed by an out-of-bounds read. On glibc release builds the same code executed cleanly for fifty runs, so observable impact depends on allocator behaviour and on concurrent allocation in a long-running multi-threaded OCR service; there is no KEV listing and no confirmed active exploitation, and the upstream advisory's sanitizer reproduction recipe is a public PoC reference that is not verified as working exploit code. Fixed in 5.5.4.
Denial of service in Tesseract OCR Engine 5.5.3 and earlier allows a local attacker to crash any process that loads a crafted .traineddata model file. The deserialization path in Plumbing::DeSerialize fails to reject a zero-length network stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED layer types; subsequent initialization in Series::CacheXScaleFactor unconditionally dereferences stack_[0] on the now-empty vector, producing a deterministic crash via an invalid virtual method call through a dangling Network pointer. No public exploit is identified at time of analysis, and no fixed release has been issued - only an upstream commit fix is available.
Out-of-bounds write in Tesseract OCR engine version 5.5.3 and earlier allows an attacker who can supply a crafted `.traineddata` file to crash the LSTM OCR pipeline through a wild-address bit write into a size-zero vector. The flaw lies in `RecodedCharID::DeSerialize`, which validates array length but silently accepts negative `code_` values; this causes `ComputeCodeRange` to produce a zero `code_range_`, after which `SetupDecoder` indexes `is_valid_start_` out of bounds, reliably producing a crash or heap allocation failure. No fixed release is available; an upstream fix commit exists but has not been tagged into a release.
Heap out-of-bounds read in Tesseract OCR prior to version 5.5.3 allows an attacker who can supply a crafted .traineddata model file to crash the OCR process before any image processing occurs. The flaw in SquishedDawg::read_squished_dawg accepts unterminated forward-edge runs, after which num_forward_edges(0) causes last_edge to read beyond the edges_ heap buffer - triggering a process crash. No public exploit has been identified at time of analysis; vendor-released patch version 5.5.3 is available and the fix is confirmed by PR #4581 and the GitHub release tag.
Heap out-of-bounds write in Tesseract OCR engine prior to 5.5.3 is triggered by a crafted LSTM .traineddata model file that causes a signed integer multiplication overflow in Convolve::DeSerialize, undersizing the forward-pass output buffer while write operations use the original unwrapped element count. Any application or user that loads an attacker-controlled model file is exposed to memory corruption that can lead to arbitrary code execution or process crash in the context of the OCR engine. No public exploit code has been identified at time of analysis, no CISA KEV listing exists, and a vendor-confirmed fix is available in Tesseract 5.5.3.
An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.