CyberRota Analysis
AI-GeneratedTesseract OCR engine versions prior to 5.5.3 are vulnerable to a heap out-of-bounds read caused by improperly crafted .traineddata models, which can lead to application crashes during image processing. This vulnerability poses a medium risk, particularly for developers and organizations utilizing Tesseract for OCR tasks, as it can disrupt service availability. Users should prioritize upgrading to version 5.5.3 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond edges_, causing a heap out-of-bounds read and process crash before image processing. This issue is fixed in version 5.5.3.