Executive brief
Tesseract is an open-source optical character recognition (OCR) engine used to extract text from images and scanned documents. A flaw in how it loads trained model files (.traineddata) allows a crafted malicious model file to cause a crash or potentially trigger memory allocation failures, disrupting OCR services that rely on this library.
Technical details
The vulnerability is an out-of-bounds write in the UnicharCompress deserialization logic (src/ccutil/unicharcompress.h and .cpp). RecodedCharID::DeSerialize validates the length_ field but fails to validate individual code_[] values, which are read as raw signed int32s. When a negative code value is supplied in a crafted .traineddata recoder component, ComputeCodeRange produces a code_range_ of zero due to improper signed integer comparison. Subsequently, SetupDecoder indexes the is_valid_start_ std::vector<bool> with the negative code on a zero-sized vector, causing an out-of-bounds write at a large wrapped memory address. The attack vector requires loading a malicious .traineddata file; the default LSTM engine is affected. The resulting crash reliably causes a denial of service; no fixed release is available as of the advisory publication date.
Affected products
- Tesseract OCR Tesseract 5.5.3 and earlier
Timeline
- 2026-09-10: disclosed
- 2026-08-25: advisory: GitHub Security Advisory GHSA-7v9h-3q3m-w68g published