The issue is a heap out‑of‑bounds pointer write caused by Tesseract’s Classify::ReadIntTemplates function reading loop bounds from the TESSDATA_INTTEMP component of a .traineddata file without validating them against defined maximums. When an attacker supplies a crafted file with excessive class pruner, class, or prototype set counts, the function writes beyond the fixed‑size arrays in INT_TEMPLATES_STRUCT and INT_CLASS_STRUCT. This overflow corrupts heap memory, causing a crash, loss of service, or, if an attacker can influence a subsequent heap allocation, potential execution of arbitrary code.

The flaw affects the open‑source OCR engine Tesseract (tesseract‑ocr:tesseract). Versions 5.5.3 and earlier contain the vulnerability; no corrected release is available at the time of review.

With a CVSS score of 8.6 the vulnerability is considered high severity. The EPSS score is not available and it is not listed in the CISA KEV catalog. Exploitation requires delivery of a malicious .traineddata file that the OCR engine processes during initialization. The attack vector depends on how the engine loads training data; if the engine can be fed untrusted data from a remote source the vector could be remote, otherwise it is local. The effect can be a crash, denial of service, or, in a worst‑case scenario where the attacker controls a heap allocation, remote code execution.