CVE-2026-73066: Tesseract: Heap out-of-bounds write in LSTM Convolve layer via crafted .traineddata
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-bounds write during OCR recognition. This issue is fixed in version 5.5.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tesseractto a version that resolves this vulnerability.Fixed in 5.5.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73066?
CVE-2026-73066 has a risk score of 70, indicating a significant vulnerability.
How do I fix CVE-2026-73066?
To fix CVE-2026-73066, upgrade to Tesseract version 5.5.3 or later.
What components are affected by CVE-2026-73066?
CVE-2026-73066 affects the LSTM Convolve layer of the Tesseract OCR engine.
What is the nature of the vulnerability in CVE-2026-73066?
CVE-2026-73066 is a heap out-of-bounds write vulnerability caused by an unchecked integer multiplication.
Can CVE-2026-73066 be exploited remotely?
Yes, CVE-2026-73066 can be exploited through crafted .traineddata files loaded by Tesseract.