CVE-2026-73067: Tesseract: Heap OOB read in the DAWG loader
Published Aug 11, 2026
·Updated
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::readsquisheddawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls numforwardedges(0) and lastedge in src/dict/dawg.h reads beyond edges, causing a heap out-of-bounds read and process crash before image processing. This issue is fixed in version 5.5.3.
Affected Software
1 affected component
Tesseract Tesseract OCR Engine<5.5.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tesseractto a version that resolves this vulnerability.Fixed in 5.5.3
Event History
Aug 11, 2026
CVE Published
via MITRE·02:51 PM
Data Sourced
via MITRE·02:51 PM
DescriptionWeakness