Tesseract's GENERIC_2D_ARRAY::DeSerializeSize function reads matrix dimensions as signed 32‑bit integers and then compares the value only against UINT16_MAX. This allows a negative number or any value up to 65535 to pass the comparison, which enables the downstream ResizeNoInit builder to allocate memory based on these incorrect dimensions. When a crafted traineddata file is processed, the resulting inconsistent allocation state can cause out‑of‑bounds memory accesses later in the loading pipeline, leading to application crashes and denial of service.

The vulnerability affects the open‑source OCR engine Tesseract, specifically all releases before 5.5.4. Users running 5.5.2, 5.5.3, or earlier are potentially affected.

The CVSS score of 5.5 indicates a moderate risk, and the EPSS score is not currently available. The vulnerability is not listed in the CISA KEV catalog. Attacks require an adversary to supply a malicious traineddata file that Tesseract processes, which may occur through local file injection or if the OCR engine is exposed to external data sources. Because the flaw leads only to denial of service rather than arbitrary code execution, the threat surface is limited to availability impact but remains significant for services relying on stable OCR processing.