{"id":"CVE-2026-73067","summary":"Tesseract: Heap OOB read in the DAWG loader","details":"Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond edges_, causing a heap out-of-bounds read and process crash before image processing. This issue is fixed in version 5.5.3.","aliases":["GHSA-x3vq-7rr7-5x3h"],"modified":"2026-08-13T08:22:34.939681Z","published":"2026-08-11T14:51:32.304Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73067.json"},"references":[{"type":"WEB","url":"https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73067.json"},{"type":"ADVISORY","url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-x3vq-7rr7-5x3h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73067"},{"type":"REPORT","url":"https://github.com/tesseract-ocr/tesseract/issues/4580"},{"type":"FIX","url":"https://github.com/tesseract-ocr/tesseract/commit/55287a94b8044c05ce3fd10f5aca6ebbd238e518"},{"type":"FIX","url":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9"},{"type":"FIX","url":"https://github.com/tesseract-ocr/tesseract/pull/4581"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tesseract-ocr/tesseract","events":[{"introduced":"0"},{"fixed":"55287a94b8044c05ce3fd10f5aca6ebbd238e518"},{"fixed":"82727cc11c34eaf1249af002d69f6bbae70993b9"},{"fixed":"db0ec62f81b0737fbbe184d8fea40af5738f8eef"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.5.3"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["5.5.2","5.5.1","5.5.0","5.4.1","5.4.0","5.4.0-rc2","5.4.0-rc1","5.3.4","5.3.3","5.3.2","5.3.1","5.3.0","5.3.0-rc1","5.2.0","5.1.0","5.0.1","5.0.0","5.0.0-rc3","5.0.0-rc2","5.0.0-rc1","5.0.0-beta-20210916","5.0.0-alpha-20210401","5.0.0-alpha-20201231","5.0.0-alpha-20201224","5.0.0-alpha","4.1.0-rc1","4.0.0","4.0.0-rc4","4.0.0-rc3","4.0.0-beta.4","4.0.0-beta.3","4.0.0-beta.1","4.00.00dev","4.00.00alpha","4.0.0-alpha","3.03-rc1","3.05.00dev","3.04.00","3.02.02","3.01","3.00","2.04","2.03","2.02","2.01","2.00","1.04b","1.04","1.03"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73067.json","vanir_signatures_modified":"2026-08-13T08:22:34Z","vanir_signatures":[{"source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/dict/dawg.cpp"},"deprecated":false,"digest":{"line_hashes":["261141771217884077666935151918414440227","263165724830959713996269312657183015269","317037058444542444670321234197885716893","63957732039631963237403439135210085136","222444617374428168165738763370341862758","291518697851239959438326206682373833701","288348572696889227077266066770392029131","258159370015695235398280934339445109662","290609833221241613405783367255583986614","197498083536121542766576755147759043514","84988987979718999023533676497178303768","196608559289847368754969631564010558065","18983311116323570414943050540543660159","278143476463830138539204756402345183291","185722681510939053240638615374287750389","29597636401571843130164630228682787415","81633366827957907134280165748006596028","84462436012475130736067071378586015177","90963700981912604071995676662685564969","3094924002354679405165429810801316147","212996840249762922392488059885257599847","100285416697045393366367078402204062304","195155804599359845738804082432237994923","163653543035010139124624809540878624929","37054401507059629483876135075796210526","184224382351041927825897212494197539373","139963749243229858807000997499909972826","199472392563047601614081267676671174393","40869668393611721762384678185282474672","264194794871798127710612193324750662839","259629268060929016621136692605954409624","288068646414250037098585345131695313867","328669979242783983480887424086564945522","23924142394883379918978880525322351946","105845644556554605040435867298768763659","243413399725160398103002014419991020752"],"threshold":0.9},"id":"CVE-2026-73067-267b4d9c","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"195654553318085001683903586987691620691","length":1262},"id":"CVE-2026-73067-2eb893a0","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/lstm/weightmatrix.cpp","function":"WeightMatrix::DeSerialize"}},{"source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/dict/dawg.cpp","function":"SquishedDawg::num_forward_edges"},"deprecated":false,"digest":{"function_hash":"254122871044249469643127394027308225831","length":196},"id":"CVE-2026-73067-32c73a97","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["230082157275816244324865323170773062073","84157868322455472169047194811420495569","99199944299144535780673338409061444494","136671389099537803616885928361357887814"]},"id":"CVE-2026-73067-4455ac37","signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/lstm/weightmatrix.cpp"}},{"digest":{"function_hash":"113949963057435117815184439505922995942","length":323},"id":"CVE-2026-73067-48d8df83","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/ccstruct/fontinfo.cpp","function":"read_info"},"deprecated":false},{"source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/ccstruct/fontinfo.cpp","function":"read_spacing_info"},"deprecated":false,"digest":{"function_hash":"296644225548824018622473659800084027565","length":723},"id":"CVE-2026-73067-52f4f046","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/dict/dawg.h","function":"NumEdges"},"deprecated":false,"digest":{"length":42,"function_hash":"23774932985727263064711824958611282248"},"id":"CVE-2026-73067-532ea0f4","signature_type":"Function"},{"digest":{"function_hash":"105782900639712511969192390869310528097","length":229},"id":"CVE-2026-73067-5928b90f","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"function":"TFile::DeSerialize","file":"src/ccutil/serialis.cpp"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/ccutil/unicharcompress.h"},"deprecated":false,"digest":{"line_hashes":["262256930562960947745680568545637996858","261301940782296510604451064122637464911","20263106437548061954091350600412222845","232338909886741334842926572551094519683","320018713060440144289028313475992698841","263869434830651801408185343531030223547","16810858758905612656402090177817808107","142439141474660201986361158061086275807","297824906375895024260098949444364373736","155952883165345233687603849918119722783","288728020257141579785875660507961326835","135196405402191263018324325540812826915","187605521076580843955815824466743843617","47650919578924893746019616547911437938","107243428564167400260841147958016839758","159787942368702840506048147175063096312","165452849192323853690332028570196507427","180084195627366193789553733806133691488","34906630219444026385921626622636046195","185854691961058752720359363406971602170","74616223376124369043255500640680385030","94832542262776783710702718809774511872","168966151373085040313892141657774634106","191085117824302710635509293985595423295","317978803979979254731470427058606318232","170040167788762857763596265821363989923","323539835356912462450696589012259702070"],"threshold":0.9},"id":"CVE-2026-73067-6012e7f3"},{"target":{"file":"src/ccutil/serialis.cpp"},"deprecated":false,"digest":{"line_hashes":["105450019095859839914602712609066398918","312798541029134713477398817511343119375","94769594979655297176420908217147657545","221911489875969504711486366230693831284","168988754852279003751863880462836640606","310677189646525766352951014565935620740","295017932709719914210263007716121105208","101411015350646130763956175850439052526","168695101819665654319531377958491987027","310677189646525766352951014565935620740","295017932709719914210263007716121105208","113358137909502563086850998689123029818"],"threshold":0.9},"id":"CVE-2026-73067-65c4b5ab","signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9"},{"deprecated":false,"digest":{"line_hashes":["90535396595816387173513844873098512124","319535866597184402207510172195589296304","71045064293089561905649658094027334691","189157796215752713312449540356312790188","237993482838762860038823874556914795403","167690738245932901490076019756583508380","161721626652869775425496854451139548479","170105023774646376909910637139328346655","191270583661287074582391208834957291362","129115939589230589785413840971238129746","22815351194951219660527633885455308729","279517480114350644350215735628182218548"],"threshold":0.9},"id":"CVE-2026-73067-7837c5d9","signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/ccutil/tessdatamanager.cpp"}},{"deprecated":false,"digest":{"function_hash":"313535419120405582885082370089882055653","length":143},"id":"CVE-2026-73067-794fdebd","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"function":"TFile::DeSerializeSkip","file":"src/ccutil/serialis.cpp"}},{"deprecated":false,"digest":{"line_hashes":["38969140240081195343325561044371851281","240608390582383105695633769857669155838","12145260745196444467855143691297907277","135116069669095197294331744794385561757","237404976957890657416865498718178610614","155601133811753603502069559200755208515","97205043527098516530219285114858661537","249366145359081053071519050043887636159","204646905207208422942103524430104033223"],"threshold":0.9},"id":"CVE-2026-73067-90b54474","signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/55287a94b8044c05ce3fd10f5aca6ebbd238e518","target":{"file":"src/dict/dawg.cpp"}},{"id":"CVE-2026-73067-96e5347b","signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/ccstruct/fontinfo.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["132045531273081538366233389156019968701","64645207966242788656738603112883855942","280731857681918138298171119367186055031","140918992488458235450623310879971704088"]}},{"deprecated":false,"digest":{"function_hash":"56691528704983485182786908521209459029","length":897},"id":"CVE-2026-73067-a8deb9f2","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/dict/dawg.cpp","function":"SquishedDawg::read_squished_dawg"}},{"target":{"file":"src/ccutil/serialis.h"},"deprecated":false,"digest":{"line_hashes":["44040214805117482475644719253593518221","291127816172162956882908523607513814640","141173558350958208213481362618776934053","43890041274966347146156816255732512171"],"threshold":0.9},"id":"CVE-2026-73067-abd74c9e","signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/55287a94b8044c05ce3fd10f5aca6ebbd238e518"},{"target":{"file":"src/lstm/plumbing.cpp"},"deprecated":false,"digest":{"line_hashes":["230082157275816244324865323170773062073","203008540354784137130078098878786324417","231949050499091548991046095629584414189","21672120500222972354062729542871880294"],"threshold":0.9},"id":"CVE-2026-73067-b748a82c","signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9"},{"source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/ccutil/bitvector.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["105942917820796885367221032082147777378","101634923924476046256259498517738597662","146439128120754151811334743617069796634","151110755691206427727424107765428523611"]},"id":"CVE-2026-73067-b793d277","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"152556992329968902931793696429173147436","length":609},"id":"CVE-2026-73067-c1fc0a4c","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/dict/dawg.cpp","function":"SquishedDawg::build_node_map"}},{"target":{"file":"src/dict/dawg.cpp","function":"SquishedDawg::read_squished_dawg"},"deprecated":false,"digest":{"function_hash":"87949680932123542948973272429706048893","length":964},"id":"CVE-2026-73067-ca3f8b0e","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/55287a94b8044c05ce3fd10f5aca6ebbd238e518"},{"id":"CVE-2026-73067-d7c7801f","signature_type":"Line","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/dict/dawg.h"},"deprecated":false,"digest":{"line_hashes":["194610144708258395845055051644211742226","218281313017455179799835583909851340577","80091505724189799060596406445819065460","172106812198418242702382087522394787554","259226524248500236145861011612392965007","96866686257824477834598319114651923470","153842929762104137168438015190809731572","180133080901777076261733950791755197050","268163847917926055632050312916557312534","192395322552121983799553791426474838961","238842037291183878717306655906370575998","101389658669935908796085965751550192166","48414931388839118584583450862929259630","250089731465076932916483452455063164353","78432277500976514240743111596724555881","271688977246627122037360751459096146280","118915322286883018015710631638721302625","195238245370547218302865250318004799374","275616246674568756085521903782634279693","51466248066632256203842514040097159559","290017929443881973576453885981987132234","35753171541441037493313442619483663610","90577729939232091408622588185410779065","170101136120993396956998041927292889509"],"threshold":0.9}},{"digest":{"function_hash":"306668372841504116616320269724809629386","length":474},"id":"CVE-2026-73067-dd381c8e","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/ccutil/bitvector.cpp","function":"BitVector::DeSerialize"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/ccstruct/fontinfo.cpp"},"deprecated":false,"digest":{"line_hashes":["124136828087902212776225665218949810502","195453068565339881514805773541216444981","230164763009450798859815228110562701836","102687575817410125312288231316156375537","172535161713191912182766575126230814915","155420245835017787140317403628474865796","85396471085114335379436336164464066628","167817267939105818913002604720040129571","281853202788738508770183305760094303561","61089379252910818653315340500410346875","77604106582452676204993754814832088231","241150860032495469932383810990653802682","14168982039528099667611018310577785041","80601818310751233291486435619553871661","200947203361524213125903070483023963935","36548465002602106489035375086474144805","70458179928163591638558960091125835449"],"threshold":0.9},"id":"CVE-2026-73067-de67691f","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"function":"SquishedDawg::edge_char_of","file":"src/dict/dawg.cpp"},"deprecated":false,"digest":{"length":648,"function_hash":"54881582751445165799657542417979443790"},"id":"CVE-2026-73067-de9c2a3d","signature_type":"Function"},{"id":"CVE-2026-73067-df00e8fc","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/ccutil/serialis.cpp","function":"TFile::DeSerialize"},"deprecated":false,"digest":{"function_hash":"197524061826442238175921916480523566222","length":241}},{"target":{"function":"Plumbing::DeSerialize","file":"src/lstm/plumbing.cpp"},"deprecated":false,"digest":{"function_hash":"282145249301438242526372996012137210710","length":468},"id":"CVE-2026-73067-e1b4db31","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"file":"src/ccutil/tessdatamanager.cpp","function":"TessdataManager::LoadMemBuffer"},"deprecated":false,"digest":{"function_hash":"280638114315414159418345726116688906793","length":1038},"id":"CVE-2026-73067-e76c30a3"},{"deprecated":false,"digest":{"function_hash":"207185345447301789240956773174975298666","length":1303},"id":"CVE-2026-73067-fc8854be","signature_type":"Function","signature_version":"v1","source":"https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9","target":{"function":"SquishedDawg::print_node","file":"src/dict/dawg.cpp"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}