Executive brief
Tesseract is an open-source optical character recognition (OCR) engine used to extract text from images and documents. A flaw in how it validates trained model files allows a specially crafted model to crash the application when loaded, preventing OCR processing from functioning. An attacker who can supply a malicious trained model file can trigger a denial-of-service condition that affects any application relying on Tesseract for text recognition.
Technical details
The vulnerability is a null-pointer dereference in the LSTM (neural network) model deserialization logic. Specifically, Plumbing::DeSerialize in plumbing.cpp validates that network stack sizes are not excessively large (rejecting sizes > 10,000) but fails to reject zero-length stacks for NT_SERIES, NT_PARALLEL, or NT_REVERSED layer types. When LSTMRecognizer initialization calls CacheXScaleFactor(XScaleFactor()) at load time, Series::CacheXScaleFactor unconditionally dereferences stack_[0] on the empty vector, resulting in a virtual method call through a wild pointer. This causes a deterministic crash with no memory corruption—purely a denial of service. The attack requires a locally-supplied or attacker-controlled .traineddata model file; no patch was available as of the advisory publication date.
Affected products
- Tesseract OCR Tesseract 5.5.3 and earlier
Timeline
- 2026-09-10: disclosed
- 2026-08-25: patched: Commit 552771236b0d80cbdb0c7dd856120fa21a4672e5 on 2026-08-25, but no fixed release available as of advisory publication