Medium severity · published Aug 11, 2026
CVE-2026-73067
Tesseract: Heap OOB read in the DAWG loader
6.7
CVSS
0.1%
EPSS
No
On KEV
Description
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond edges_, causing a heap out-of-bounds read and process crash before image processing. This issue is fixed in version 5.5.3.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
tesseract · tesseract-ocr
< 5.5.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73067
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73067
github.com
https://github.com/tesseract-ocr/tesseract/commit/55287a94b8044c05ce3fd10f5aca6ebbd238e518
github.com
https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9
github.com
https://github.com/tesseract-ocr/tesseract/issues/4580
github.com
https://github.com/tesseract-ocr/tesseract/pull/4581
github.com
https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3
github.com
https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-x3vq-7rr7-5x3h
More from tesseract
7.8
CVE-2026-88053
Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata
7.8
CVE-2026-88052
Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization
7.8
CVE-2026-88051
Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fields
7.8
CVE-2026-88047
Tesseract: ReadNormProtos stack buffer overflow
7.1
CVE-2026-88048
Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matrix dimension mismatch