CVE-2026-73066: Tesseract OCR Buffer Overflow Vulnerability

CVE-2026-73066 Overview

CVE-2026-73066 is a heap out-of-bounds write vulnerability in Tesseract, an open source Optical Character Recognition (OCR) engine. The flaw exists in the LSTM model deserializer, specifically in Convolve::DeSerialize in src/lstm/convolve.cpp. A crafted .traineddata file triggers an unchecked signed integer multiplication that wraps the convolution output-channel count. This undersizes the forward-pass output buffer while writes proceed using the unwrapped element count, producing a heap out-of-bounds write during OCR recognition. The vulnerability is classified under [CWE-787] (Out-of-bounds Write) and is fixed in Tesseract 5.5.3.

Critical Impact
Loading an attacker-controlled .traineddata model into a vulnerable Tesseract build corrupts heap memory during OCR recognition, enabling process compromise or denial of service.

Affected Products

Tesseract OCR versions prior to 5.5.3
Applications and services that embed the Tesseract library for OCR processing
Downstream language bindings and wrappers that link against vulnerable Tesseract builds

Discovery Timeline

2026-08-11 - CVE-2026-73066 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73066

Vulnerability Analysis

Tesseract loads neural network model data from .traineddata files through a custom deserializer. When the deserializer processes a Convolve layer, it reads network dimensions and computes the convolution output-channel count. The computation performs a signed integer multiplication without validating the operands or checking for overflow. A crafted model file supplies dimensions that cause the multiplication to wrap, producing a small or negative element count. Tesseract then allocates a forward-pass output buffer sized by the wrapped value while the writing logic uses the original, unwrapped element count. The mismatch produces a heap out-of-bounds write during OCR recognition, corrupting adjacent heap memory.

Root Cause

The root cause is missing input validation on network layer parameters during LSTM deserialization. The patch adds explicit bounds checks that reject negative values for ni, no, and num_weights before allocation. Prior to 5.5.3, no such validation existed, and the signed multiplication was assumed to produce a valid, positive element count.

Attack Vector

Exploitation requires a local user to load a malicious .traineddata file into a vulnerable Tesseract process. The attack vector is local with user interaction, since the victim application must be directed to use the crafted model. Automated document processing pipelines that accept externally supplied model files broaden the practical attack surface.

cpp

// Patch: src/lstm/convolve.cpp - add cstdint and diagnostic headers
#include "convolve.h"

#include <cstdint>

#include "networkscratch.h"
#include "serialis.h"
#include "tprintf.h"

namespace tesseract {

Source: GitHub Commit 2f4d2f4b

cpp

// Patch: src/lstm/network.cpp - reject negative layer parameters before allocation
  return nullptr;
}

if (ni < 0 || no < 0 || num_weights < 0) {
  tprintf("Error: invalid network layer parameters: type=%d ni=%d no=%d num_weights=%d\n", type,
          ni, no, num_weights);
  return nullptr;
}

switch (type) {
  case NT_CONVOLVE:
    network = new Convolve(name, ni, 0, 0);

Source: GitHub Commit 2f4d2f4b. The fix short-circuits deserialization when any layer parameter is negative, blocking the overflow path.

Detection Methods for CVE-2026-73066

Indicators of Compromise

Tesseract process crashes, heap corruption warnings, or aborts logged during OCR recognition on user-supplied .traineddata files
Presence of .traineddata files from untrusted sources in Tesseract's tessdata directory or in application-specific model paths
Unexpected diagnostic output containing invalid network layer parameters after upgrading to 5.5.3, indicating a rejected malicious model

Detection Strategies

Inventory all systems running Tesseract and compare installed versions against 5.5.3 to identify vulnerable builds
Monitor file writes to tessdata directories and flag .traineddata files not originating from trusted distribution channels
Enable AddressSanitizer or heap protection in test environments to surface out-of-bounds writes when processing suspect models

Monitoring Recommendations

Collect process telemetry for Tesseract and downstream OCR services, alerting on abnormal terminations or SIGSEGV/SIGABRT signals
Log the provenance and hash of every .traineddata file loaded by production OCR pipelines
Forward Tesseract stderr diagnostics to centralized logging to capture the new invalid network layer parameters message from the patched build

How to Mitigate CVE-2026-73066

Immediate Actions Required

Upgrade Tesseract to version 5.5.3 or later on all systems performing OCR
Restrict write access to directories containing .traineddata files to trusted administrators only
Audit application code paths that load user- or network-supplied model files and block untrusted sources

Patch Information

The fix is delivered in Tesseract 5.5.3 through Pull Request #4588. Details are published in GitHub Security Advisory GHSA-7j76-5rq5-5jg8. The patch adds signed-value bounds checks in Network::CreateFromFile and includes <cstdint> plus tprintf.h in convolve.cpp for diagnostics.

Workarounds

Load only .traineddata models distributed by the Tesseract project or trusted internal sources
Isolate OCR processing in a sandboxed or containerized environment with minimal privileges and no access to sensitive data
Validate the SHA-256 hash of every model file against a known-good allowlist before invoking Tesseract

bash

# Verify installed Tesseract version and validate model provenance
tesseract --version

# Hash-check trained data files against an allowlist before use
sha256sum /usr/share/tesseract-ocr/*/tessdata/*.traineddata

# Restrict permissions on the tessdata directory
chown -R root:root /usr/share/tesseract-ocr/*/tessdata
chmod -R 0644 /usr/share/tesseract-ocr/*/tessdata/*.traineddata