Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-bounds write during OCR recognition. This issue is fixed in version 5.5.3.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tesseractUpgrade tesseract-devel | Oct 11, 2026 | Sep 16, 2026 |
| Redhat_linux | — | Upgrade tesseract-develUpgrade tesseract-debugsourceUpgrade tesseractUpgrade tesseract-tools-debuginfoUpgrade tesseract-debuginfo | Aug 26, 2026 | Aug 11, 2026 |
| Rocky_linux | — | Upgrade tesseract-debugsourceUpgrade tesseract-develUpgrade tesseractUpgrade tesseract-debuginfo | Sep 18, 2026 | Sep 17, 2026 |
| Ubuntu | — | Upgrade libtesseract3 (Ubuntu Pro)Upgrade libtesseract4 (Ubuntu Pro)Upgrade libtesseract5 (Ubuntu Pro) | Oct 7, 2026 | Oct 6, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub