CyberRota Analysis
AI-GeneratedTesseract's OCR engine prior to version 5.5.3 is vulnerable to a heap out-of-bounds write due to an unchecked signed integer multiplication in its deserialization process for LSTM model components. This flaw can lead to potential memory corruption during OCR recognition, which may be exploited to execute arbitrary code or crash the application. Organizations using Tesseract for OCR tasks should prioritize updating to version 5.5.3 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-bounds write during OCR recognition. This issue is fixed in version 5.5.3.