CVE-2026-73067
- Source
- https://cve.org/CVERecord?id=CVE-2026-73067
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-73067.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-73067
- Aliases
-
- GHSA-x3vq-7rr7-5x3h
- Downstream
- Published
- 2026-08-11T14:51:32Z
- Modified
- 2026-08-18T18:23:01Z
- Severity
-
- 6.7 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Tesseract: Heap OOB read in the DAWG loader
- Details
-
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond edges_, causing a heap out-of-bounds read and process crash before image processing. This issue is fixed in version 5.5.3.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-125" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73067.json" }- References
-
- https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73067.json
- https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-x3vq-7rr7-5x3h
- https://nvd.nist.gov/vuln/detail/CVE-2026-73067
- https://github.com/tesseract-ocr/tesseract/issues/4580
- https://github.com/tesseract-ocr/tesseract/commit/55287a94b8044c05ce3fd10f5aca6ebbd238e518
- https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9
- https://github.com/tesseract-ocr/tesseract/pull/4581
Affected packages
Git / github.com/tesseract-ocr/tesseract
Affected ranges
- Type
- GIT
- Repo
- https://github.com/tesseract-ocr/tesseract
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "5.5.3" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
1.*
1.03
1.04
1.04b
2.*
2.00
2.01
2.02
2.03
2.04
3.*
3.00
3.01
3.02.02
3.03-rc1
3.04.00
3.05.00dev
4.*
4.0.0
4.0.0-alpha
4.0.0-beta.1
4.0.0-beta.3
4.0.0-beta.4
4.0.0-rc3
4.0.0-rc4
4.00.00alpha
4.00.00dev
4.1.0-rc1
5.*
5.0.0
5.0.0-alpha
5.0.0-alpha-20201224
5.0.0-alpha-20201231
5.0.0-alpha-20210401
5.0.0-beta-20210916
5.0.0-rc1
5.0.0-rc2
5.0.0-rc3
5.0.1
5.1.0
5.2.0
5.3.0
5.3.0-rc1
5.3.1
5.3.2
5.3.3
5.3.4
5.4.0
5.4.0-rc1
5.4.0-rc2
5.4.1
5.5.0
5.5.1
5.5.2
Database specific
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-73067.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"261141771217884077666935151918414440227",
"263165724830959713996269312657183015269",
"317037058444542444670321234197885716893",
"63957732039631963237403439135210085136",
"222444617374428168165738763370341862758",
"291518697851239959438326206682373833701",
"288348572696889227077266066770392029131",
"258159370015695235398280934339445109662",
"290609833221241613405783367255583986614",
"197498083536121542766576755147759043514",
"84988987979718999023533676497178303768",
"196608559289847368754969631564010558065",
"18983311116323570414943050540543660159",
"278143476463830138539204756402345183291",
"185722681510939053240638615374287750389",
"29597636401571843130164630228682787415",
"81633366827957907134280165748006596028",
"84462436012475130736067071378586015177",
"90963700981912604071995676662685564969",
"3094924002354679405165429810801316147",
"212996840249762922392488059885257599847",
"100285416697045393366367078402204062304",
"195155804599359845738804082432237994923",
"163653543035010139124624809540878624929",
"37054401507059629483876135075796210526",
"184224382351041927825897212494197539373",
"139963749243229858807000997499909972826",
"199472392563047601614081267676671174393",
"40869668393611721762384678185282474672",
"264194794871798127710612193324750662839",
"259629268060929016621136692605954409624",
"288068646414250037098585345131695313867",
"328669979242783983480887424086564945522",
"23924142394883379918978880525322351946",
"105845644556554605040435867298768763659",
"243413399725160398103002014419991020752"
],
"threshold": 0.9
},
"id": "CVE-2026-73067-267b4d9c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/dict/dawg.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "195654553318085001683903586987691620691",
"length": 1262
},
"id": "CVE-2026-73067-2eb893a0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/lstm/weightmatrix.cpp",
"function": "WeightMatrix::DeSerialize"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "254122871044249469643127394027308225831",
"length": 196
},
"id": "CVE-2026-73067-32c73a97",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/dict/dawg.cpp",
"function": "SquishedDawg::num_forward_edges"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"230082157275816244324865323170773062073",
"84157868322455472169047194811420495569",
"99199944299144535780673338409061444494",
"136671389099537803616885928361357887814"
],
"threshold": 0.9
},
"id": "CVE-2026-73067-4455ac37",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/lstm/weightmatrix.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "113949963057435117815184439505922995942",
"length": 323
},
"id": "CVE-2026-73067-48d8df83",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/ccstruct/fontinfo.cpp",
"function": "read_info"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "296644225548824018622473659800084027565",
"length": 723
},
"id": "CVE-2026-73067-52f4f046",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/ccstruct/fontinfo.cpp",
"function": "read_spacing_info"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "23774932985727263064711824958611282248",
"length": 42
},
"id": "CVE-2026-73067-532ea0f4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/dict/dawg.h",
"function": "NumEdges"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "105782900639712511969192390869310528097",
"length": 229
},
"id": "CVE-2026-73067-5928b90f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/ccutil/serialis.cpp",
"function": "TFile::DeSerialize"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"262256930562960947745680568545637996858",
"261301940782296510604451064122637464911",
"20263106437548061954091350600412222845",
"232338909886741334842926572551094519683",
"320018713060440144289028313475992698841",
"263869434830651801408185343531030223547",
"16810858758905612656402090177817808107",
"142439141474660201986361158061086275807",
"297824906375895024260098949444364373736",
"155952883165345233687603849918119722783",
"288728020257141579785875660507961326835",
"135196405402191263018324325540812826915",
"187605521076580843955815824466743843617",
"47650919578924893746019616547911437938",
"107243428564167400260841147958016839758",
"159787942368702840506048147175063096312",
"165452849192323853690332028570196507427",
"180084195627366193789553733806133691488",
"34906630219444026385921626622636046195",
"185854691961058752720359363406971602170",
"74616223376124369043255500640680385030",
"94832542262776783710702718809774511872",
"168966151373085040313892141657774634106",
"191085117824302710635509293985595423295",
"317978803979979254731470427058606318232",
"170040167788762857763596265821363989923",
"323539835356912462450696589012259702070"
],
"threshold": 0.9
},
"id": "CVE-2026-73067-6012e7f3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/ccutil/unicharcompress.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"105450019095859839914602712609066398918",
"312798541029134713477398817511343119375",
"94769594979655297176420908217147657545",
"221911489875969504711486366230693831284",
"168988754852279003751863880462836640606",
"310677189646525766352951014565935620740",
"295017932709719914210263007716121105208",
"101411015350646130763956175850439052526",
"168695101819665654319531377958491987027",
"310677189646525766352951014565935620740",
"295017932709719914210263007716121105208",
"113358137909502563086850998689123029818"
],
"threshold": 0.9
},
"id": "CVE-2026-73067-65c4b5ab",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/ccutil/serialis.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"90535396595816387173513844873098512124",
"319535866597184402207510172195589296304",
"71045064293089561905649658094027334691",
"189157796215752713312449540356312790188",
"237993482838762860038823874556914795403",
"167690738245932901490076019756583508380",
"161721626652869775425496854451139548479",
"170105023774646376909910637139328346655",
"191270583661287074582391208834957291362",
"129115939589230589785413840971238129746",
"22815351194951219660527633885455308729",
"279517480114350644350215735628182218548"
],
"threshold": 0.9
},
"id": "CVE-2026-73067-7837c5d9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/ccutil/tessdatamanager.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "313535419120405582885082370089882055653",
"length": 143
},
"id": "CVE-2026-73067-794fdebd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/ccutil/serialis.cpp",
"function": "TFile::DeSerializeSkip"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"38969140240081195343325561044371851281",
"240608390582383105695633769857669155838",
"12145260745196444467855143691297907277",
"135116069669095197294331744794385561757",
"237404976957890657416865498718178610614",
"155601133811753603502069559200755208515",
"97205043527098516530219285114858661537",
"249366145359081053071519050043887636159",
"204646905207208422942103524430104033223"
],
"threshold": 0.9
},
"id": "CVE-2026-73067-90b54474",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/55287a94b8044c05ce3fd10f5aca6ebbd238e518",
"target": {
"file": "src/dict/dawg.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"132045531273081538366233389156019968701",
"64645207966242788656738603112883855942",
"280731857681918138298171119367186055031",
"140918992488458235450623310879971704088"
],
"threshold": 0.9
},
"id": "CVE-2026-73067-96e5347b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/ccstruct/fontinfo.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "56691528704983485182786908521209459029",
"length": 897
},
"id": "CVE-2026-73067-a8deb9f2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/dict/dawg.cpp",
"function": "SquishedDawg::read_squished_dawg"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"44040214805117482475644719253593518221",
"291127816172162956882908523607513814640",
"141173558350958208213481362618776934053",
"43890041274966347146156816255732512171"
],
"threshold": 0.9
},
"id": "CVE-2026-73067-abd74c9e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/55287a94b8044c05ce3fd10f5aca6ebbd238e518",
"target": {
"file": "src/ccutil/serialis.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"230082157275816244324865323170773062073",
"203008540354784137130078098878786324417",
"231949050499091548991046095629584414189",
"21672120500222972354062729542871880294"
],
"threshold": 0.9
},
"id": "CVE-2026-73067-b748a82c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/lstm/plumbing.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"105942917820796885367221032082147777378",
"101634923924476046256259498517738597662",
"146439128120754151811334743617069796634",
"151110755691206427727424107765428523611"
],
"threshold": 0.9
},
"id": "CVE-2026-73067-b793d277",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/ccutil/bitvector.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "152556992329968902931793696429173147436",
"length": 609
},
"id": "CVE-2026-73067-c1fc0a4c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/dict/dawg.cpp",
"function": "SquishedDawg::build_node_map"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "87949680932123542948973272429706048893",
"length": 964
},
"id": "CVE-2026-73067-ca3f8b0e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/55287a94b8044c05ce3fd10f5aca6ebbd238e518",
"target": {
"file": "src/dict/dawg.cpp",
"function": "SquishedDawg::read_squished_dawg"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"194610144708258395845055051644211742226",
"218281313017455179799835583909851340577",
"80091505724189799060596406445819065460",
"172106812198418242702382087522394787554",
"259226524248500236145861011612392965007",
"96866686257824477834598319114651923470",
"153842929762104137168438015190809731572",
"180133080901777076261733950791755197050",
"268163847917926055632050312916557312534",
"192395322552121983799553791426474838961",
"238842037291183878717306655906370575998",
"101389658669935908796085965751550192166",
"48414931388839118584583450862929259630",
"250089731465076932916483452455063164353",
"78432277500976514240743111596724555881",
"271688977246627122037360751459096146280",
"118915322286883018015710631638721302625",
"195238245370547218302865250318004799374",
"275616246674568756085521903782634279693",
"51466248066632256203842514040097159559",
"290017929443881973576453885981987132234",
"35753171541441037493313442619483663610",
"90577729939232091408622588185410779065",
"170101136120993396956998041927292889509"
],
"threshold": 0.9
},
"id": "CVE-2026-73067-d7c7801f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/dict/dawg.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "306668372841504116616320269724809629386",
"length": 474
},
"id": "CVE-2026-73067-dd381c8e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/ccutil/bitvector.cpp",
"function": "BitVector::DeSerialize"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"124136828087902212776225665218949810502",
"195453068565339881514805773541216444981",
"230164763009450798859815228110562701836",
"102687575817410125312288231316156375537",
"172535161713191912182766575126230814915",
"155420245835017787140317403628474865796",
"85396471085114335379436336164464066628",
"167817267939105818913002604720040129571",
"281853202788738508770183305760094303561",
"61089379252910818653315340500410346875",
"77604106582452676204993754814832088231",
"241150860032495469932383810990653802682",
"14168982039528099667611018310577785041",
"80601818310751233291486435619553871661",
"200947203361524213125903070483023963935",
"36548465002602106489035375086474144805",
"70458179928163591638558960091125835449"
],
"threshold": 0.9
},
"id": "CVE-2026-73067-de67691f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/ccstruct/fontinfo.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "54881582751445165799657542417979443790",
"length": 648
},
"id": "CVE-2026-73067-de9c2a3d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/dict/dawg.cpp",
"function": "SquishedDawg::edge_char_of"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "197524061826442238175921916480523566222",
"length": 241
},
"id": "CVE-2026-73067-df00e8fc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/ccutil/serialis.cpp",
"function": "TFile::DeSerialize"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "282145249301438242526372996012137210710",
"length": 468
},
"id": "CVE-2026-73067-e1b4db31",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/lstm/plumbing.cpp",
"function": "Plumbing::DeSerialize"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "280638114315414159418345726116688906793",
"length": 1038
},
"id": "CVE-2026-73067-e76c30a3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/ccutil/tessdatamanager.cpp",
"function": "TessdataManager::LoadMemBuffer"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "207185345447301789240956773174975298666",
"length": 1303
},
"id": "CVE-2026-73067-fc8854be",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9",
"target": {
"file": "src/dict/dawg.cpp",
"function": "SquishedDawg::print_node"
}
}
]
vanir_signatures_modified
"2026-08-18T18:23:01Z"