Tesseract, an open source OCR engine, contains a heap out‑of‑bounds read that can be triggered by a crafted .traineddata model. The vulnerable code path occurs when the machine learning model is loaded through TessBaseAPI::Init, leading SquishedDawg to read beyond the allocated edges array and crash the process. This results in a denial of service, though it does not provide a foothold for code execution.

All installations of Tesseract versions prior to 5.5.3 are affected, regardless of operating system, because the flaw resides in the core dictionary loader shared across platforms. The vulnerability is present in the tesseract-ocr:tesseract product as listed by the CNA.

The CVSS score of 6.7 indicates a moderate severity. EPSS data is not available, and the issue is not in CISA’s KEV catalog, implying no known widespread exploitation yet. An attacker must supply or influence the .traineddata file used during TessBaseAPI::Init; local or remote code that can place a crafted model pathway will expose the system to crashes.