USN-8882-1: Tesseract vulnerabilities
Ubuntu’s USN-8882-1 fixes Tesseract flaws in crafted .traineddata models that can crash the engine or execute code.
Ubuntu published USN-8882-1 for vulnerabilities in Tesseract triggered by crafted .traineddata models. CVE-2026-73067 can crash the OCR engine and cause denial of service. CVE-2026-73066, from improper dimension checks, and CVE-2026-88047, from unbounded token lengths, could allow arbitrary code execution. The notice also describes insufficient validation of layer dimensions; no exploitation is reported.
- USN-8882-1 covers multiple Tesseract flaws in crafted .traineddata models.
- CVE-2026-73067 can crash Tesseract and cause a denial of service.
- CVE-2026-73066 and CVE-2026-88047 may allow arbitrary code execution.
- A further layer-dimension validation issue is described, but its CVE is not shown.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-73066+1 related CVE | Tesseract: A crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer… | 6.8 group max | <1% | ||
| CVE-2026-88047 | Stack Buffer Overflow in Tesseract OCR (<= 5.5.3) via Malicious .traineddata Files | 8.6 | — |
From the original article
It was discovered that Tesseract incorrectly handled crafted . traineddata models. An attacker could possibly use this issue to cause Tesseract to crash, resulting in a denial of service.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.