In Tesseract OCR versions 5.5.3 and earlier, the FullyConnected::DeSerialize function does not validate the layer scalar dimensions ni_ and no_ against the weight‑matrix dimensions. During a forward pass, MatrixDotVector writes data into a temporary buffer sized from no_ and reads inputs sized from ni_, allowing an attacker to supply a crafted .traineddata file with mismatched dimensions. This can cause a heap out‑of‑bounds write and read, leading to heap corruption, application crashes, information disclosure, or in the worst case controlled memory corruption. The vulnerability exists in the default LSTM engine and persists in all affected releases.

The vulnerability affects the open‑source Tesseract OCR engine, specifically versions 5.5.3 and all earlier releases; the product is known as tesseract‑ocr tesseract. No fixed release is available as of this review.

The CVSS score of 8.6 indicates high severity, yet the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited or unknown exploitation. The likely attack vector requires an attacker to supply a malicious .traineddata file that includes an NT_SOFTMAX layer with inconsistent dimensions, which requires that the attacker’s data be processed by tesseract, either locally or on a system where the engine runs with elevated privileges. The lack of a published exploit does not reduce the potential impact, as the affected code paths are readily usable by an attacker with access to the input pipeline.