Technical impact
The vulnerability arises when the OCR engine's UNICHARSET loader trusts an externally supplied unichar count as a loop bound and uses it as an index into a vector that may be smaller than that count. This desynchronization leads to an out‑of‑bounds write to the vector’s properties field, corrupting heap memory during engine initialization. The corruption manifests as crashes or, if an attacker can carefully craft the unicharset file, potential controlled memory writes. The affected code paths are exercised by both the default LSTM and legacy engines.
Affected Systems
The flaw exists in the Tesseract OCR engine provided by the tesseract-ocr project. Versions up to and including 5.5.3 are vulnerable; later releases have not yet been patched. Users running these versions on any platform are potentially impacted.
Risk and Exploitability
The CVSS score of 7.8 indicates a high severity, and the lack of an available EPSS score means the current probability of exploitation is not quantified. Since the bug requires a malicious unicharset file to be read during startup, the attack vector is likely could broaden its reach. The vulnerability is not listed in CISA's KEV catalog, but its impact on memory integrity and the absence of a fix suggest that administrative vigilance and privilege restriction are prudent until an update is released.
Ubuntu USN