Medium severity · published Aug 11, 2026
CVE-2026-73066
Tesseract: Heap out-of-bounds write in LSTM Convolve layer via crafted .traineddata
6.8
CVSS
0.1%
EPSS
No
On KEV
Description
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-bounds write during OCR recognition. This issue is fixed in version 5.5.3.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
tesseract · tesseract-ocr
< 5.5.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73066
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73066
github.com
https://github.com/tesseract-ocr/tesseract/commit/2f4d2f4bf45c363785d7bf1da29b6628f8939a72
github.com
https://github.com/tesseract-ocr/tesseract/pull/4588
github.com
https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3
github.com
https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7j76-5rq5-5jg8
More from tesseract
7.8
CVE-2026-88053
Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata
7.8
CVE-2026-88052
Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization
7.8
CVE-2026-88051
Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fields
7.8
CVE-2026-88047
Tesseract: ReadNormProtos stack buffer overflow
7.1
CVE-2026-88048
Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matrix dimension mismatch