Critical Security Update for Tesseract: Heap Out-of-Bounds Write Vulnerability
Summary
ALSA-2026:67832: Important: tesseract security update. Affects tesseract versions < 4.1.1-3.el8_10. Fixed in 4.1.1-3.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tesseract is a commercial quality Optical Character Recognition (OCR) engine that was originally developed at HP between 1985 and 1995. It has been recognized for its high accuracy and was among the top evaluated OCR engines by UNLV in 1995. Open-sourced in 2005, Tesseract is widely used for converting images of text into machine-encoded text. However, it is susceptible to security vulnerabilities, including the recent heap out-of-bounds write issue.
Vulnerability Detail
The vulnerability identified as CVE-2026-73066 allows for a heap out-of-bounds write through crafted .traineddata files. This can lead to potential exploitation, where an attacker could manipulate the memory of the application, resulting in crashes or arbitrary code execution. The issue arises from improper handling of input data, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
4.1.1-3.el8_10
This is the first release that contains the fix.
sudo dnf update tesseractTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the security update as soon as it is available.
Conclusion
In summary, the Tesseract OCR engine has a critical vulnerability that requires immediate attention. Users are advised to update to the latest patched version to protect against potential exploitation. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for tesseract →
FAQ
CVE-2026-73066 is a vulnerability in Tesseract that allows for a heap out-of-bounds write via crafted .traineddata files.
The vulnerability could lead to application crashes or arbitrary code execution, posing significant security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
Yes, a patch is available in the form of an updated version of Tesseract, specifically version 4.1.1-3.el8_10.
While there are no specific workarounds, it is crucial to prioritize updating the package to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for tesseract.
