CVE-2026-73067

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond edges_, causing a heap out-of-bounds read and process crash before image processing. This issue is fixed in version 5.5.3.

• CWE-125

• https://github.com/tesseract-ocr/tesseract/commit/55287a94b8044c05ce3fd10f5aca6ebbd238e518
• https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9
• https://github.com/tesseract-ocr/tesseract/issues/4580
• https://github.com/tesseract-ocr/tesseract/pull/4581
• https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-x3vq-7rr7-5x3h

Published

Aug 11, 2026

Last Modified

Aug 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73035npm-check-updates through 23.0.2, fixed in commit b554b84, c…5.3
• CVE-2026-73036Bash-it 3.2.0 contains a terminal escape sequence injection …4.6
• CVE-2026-7304SGLangs multimodal generation runtime is vulnerable to unaut…9.8
• CVE-2026-7305A weakness has been identified in Xuxueli xxl-job up to 3.3.…6.3
• CVE-2026-7306A security vulnerability has been detected in Xuxueli xxl-jo…5.6
• CVE-2026-73066Tesseract is an open source OCR engine. Prior to 5.5.3, a cr…6.8
• CVE-2026-73068ToolJet is the open-source foundation am AI-native platform …5.9
• CVE-2026-73069Twenty is an open-source CRM (customer relationship manageme…9.1
• CVE-2026-7307A flaw was found in Keycloak. A remote, unauthenticated atta…7.5
• CVE-2026-73070Vim is an open source, command line text editor. Prior to 9.…6.8
• CVE-2026-73071Vim is an open source, command line text editor. From 9.2.05…3.3
• CVE-2026-73072Vim is an open source, command line text editor. Prior to 9.…8.5