Critical Security Update for Tesseract: Heap Out-of-Bounds Write Vulnerability
Summary
ALSA-2026:67831: Important: tesseract security update. Affects tesseract versions < 4.1.1-8.el9_8. Fixed in 4.1.1-8.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tesseract is a commercial quality Optical Character Recognition (OCR) engine that was originally developed at HP between 1985 and 1995. It has been recognized for its high performance and was among the top three evaluated by UNLV in 1995. Open-sourced in 2005, Tesseract is widely used for converting images of text into machine-encoded text. However, it has recently been found to have a significant security vulnerability that could be exploited if not addressed.
Vulnerability Detail
The vulnerability identified as CVE-2026-73066 involves a heap out-of-bounds write that can occur when Tesseract processes a specially crafted .traineddata file. This flaw could allow an attacker to execute arbitrary code, potentially leading to system compromise. The issue arises from improper handling of memory allocation, which can be exploited to overwrite critical memory areas.
How To Fix
Minimum fixed version
4.1.1-8.el9_8
This is the first release that contains the fix.
sudo dnf update tesseractTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid processing untrusted or unknown .traineddata files until the update is applied. Additionally, implementing strict file validation can help mitigate the risk of exploitation.
Conclusion
The Tesseract OCR engine has a critical vulnerability that requires immediate attention. Users are advised to update to the latest patched version to mitigate the risks associated with this security flaw. By following the provided steps, users can ensure their systems remain secure.
See every vulnerability recorded for tesseract →
FAQ
The vulnerability is a heap out-of-bounds write that can be exploited through specially crafted .traineddata files.
If you are using a version prior to 4.1.1-8.el9_8, your installation is vulnerable.
Exploitation of this vulnerability could lead to arbitrary code execution, compromising the security of the affected system.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities without requiring signup.
Related vulnerabilities
Recent vulnerabilities recorded for tesseract.
