NIXPKGS-2026-2407

GitHub issue published 4 weeks, 1 day ago

tesseract: security issues < 5.5.3 (needs backport)

Permalink CVE-2026-73067

6.7 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 4 weeks, 1 day ago by @LeSuisse Activity log

Created suggestion 4 weeks, 2 days ago
@LeSuisse ignored
6 packages
- tesseract3
- tesseract4
- python313Packages.pytesseract
- python314Packages.pytesseract
- perlPackages.ImageOCRTesseract
- perl5Packages.ImageOCRTesseract
4 weeks, 1 day ago
@LeSuisse accepted 4 weeks, 1 day ago
@LeSuisse published on GitHub 4 weeks, 1 day ago

Tesseract: Heap OOB read in the DAWG loader

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond edges_, causing a heap out-of-bounds read and process crash before image processing. This issue is fixed in version 5.5.3.

References

https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-x3vq-7rr7-5x3h x_refsource_CONFIRM
https://github.com/tesseract-ocr/tesseract/issues/4580 x_refsource_MISC
https://github.com/tesseract-ocr/tesseract/pull/4581 x_refsource_MISC
https://github.com/tesseract-ocr/tesseract/commit/55287a94b8044c05ce3fd10f5aca6ebbd238e518 x_refsource_MISC
https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9 x_refsource_MISC
https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3 x_refsource_MISC

Affected products

tesseract

==< 5.5.3

Matching in nixpkgs

pkgs.tesseract

OCR engine

nixos-unstable 5.5.2
- nixpkgs-unstable 5.5.2
- nixos-unstable-small 5.5.3
nixos-26.05 5.5.2
- nixos-26.05-small 5.5.2
- nixpkgs-26.05-darwin 5.5.2

pkgs.tesseract5

OCR engine

nixos-unstable 5.5.2
- nixpkgs-unstable 5.5.2
- nixos-unstable-small 5.5.3
nixos-26.05 5.5.2
- nixos-26.05-small 5.5.2
- nixpkgs-26.05-darwin 5.5.2

Ignored packages (6)

pkgs.tesseract3

OCR engine

nixos-unstable 3.05.02
- nixpkgs-unstable 3.05.02
- nixos-unstable-small 3.05.02
nixos-26.05 3.05.02
- nixos-26.05-small 3.05.02
- nixpkgs-26.05-darwin 3.05.02

pkgs.tesseract4

OCR engine

nixos-unstable 4.1.3
- nixpkgs-unstable 4.1.3
- nixos-unstable-small 4.1.3
nixos-26.05 4.1.3
- nixos-26.05-small 4.1.3
- nixpkgs-26.05-darwin 4.1.3

pkgs.python313Packages.pytesseract

Python wrapper for Google Tesseract

nixos-unstable 0.3.13
- nixpkgs-unstable 0.3.13
- nixos-unstable-small 0.3.13
nixos-26.05 0.3.13
- nixos-26.05-small 0.3.13
- nixpkgs-26.05-darwin 0.3.13

pkgs.python314Packages.pytesseract

Python wrapper for Google Tesseract

nixos-unstable 0.3.13
- nixpkgs-unstable 0.3.13
- nixos-unstable-small 0.3.13
nixos-26.05 0.3.13
- nixos-26.05-small 0.3.13
- nixpkgs-26.05-darwin 0.3.13

pkgs.perlPackages.ImageOCRTesseract

Read an image with tesseract ocr and get output

nixos-unstable 1.26
- nixpkgs-unstable 1.26
- nixos-unstable-small 1.26
nixos-26.05 1.26
- nixos-26.05-small 1.26
- nixpkgs-26.05-darwin 1.26

pkgs.perl5Packages.ImageOCRTesseract

Read an image with tesseract ocr and get output

nixos-unstable 1.26
- nixpkgs-unstable 1.26
- nixos-unstable-small 1.26
nixos-26.05 1.26
- nixos-26.05-small 1.26
- nixpkgs-26.05-darwin 1.26

Package maintainers

@PatrickDaG Patrick <patrick-nixos@failmail.dev>

Needs backport

Permalink CVE-2026-73066

6.8 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 4 weeks, 1 day ago by @LeSuisse Activity log

Created suggestion 4 weeks, 2 days ago
@LeSuisse ignored
6 packages
- tesseract3
- tesseract4
- python313Packages.pytesseract
- python314Packages.pytesseract
- perlPackages.ImageOCRTesseract
- perl5Packages.ImageOCRTesseract
4 weeks, 1 day ago
@LeSuisse accepted 4 weeks, 1 day ago
@LeSuisse published on GitHub 4 weeks, 1 day ago

Tesseract: Heap out-of-bounds write in LSTM Convolve layer via crafted .traineddata

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-bounds write during OCR recognition. This issue is fixed in version 5.5.3.

References

https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7j76-5rq5-5jg8 x_refsource_CONFIRM
https://github.com/tesseract-ocr/tesseract/pull/4588 x_refsource_MISC
https://github.com/tesseract-ocr/tesseract/commit/2f4d2f4bf45c363785d7bf1da29b6628f8939a72 x_refsource_MISC
https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3 x_refsource_MISC

Affected products

tesseract

==< 5.5.3

Matching in nixpkgs

pkgs.tesseract

OCR engine

nixos-unstable 5.5.2
- nixpkgs-unstable 5.5.2
- nixos-unstable-small 5.5.3
nixos-26.05 5.5.2
- nixos-26.05-small 5.5.2
- nixpkgs-26.05-darwin 5.5.2

pkgs.tesseract5

OCR engine

nixos-unstable 5.5.2
- nixpkgs-unstable 5.5.2
- nixos-unstable-small 5.5.3
nixos-26.05 5.5.2
- nixos-26.05-small 5.5.2
- nixpkgs-26.05-darwin 5.5.2

Ignored packages (6)

pkgs.tesseract3

OCR engine

nixos-unstable 3.05.02
- nixpkgs-unstable 3.05.02
- nixos-unstable-small 3.05.02
nixos-26.05 3.05.02
- nixos-26.05-small 3.05.02
- nixpkgs-26.05-darwin 3.05.02

pkgs.tesseract4

OCR engine

nixos-unstable 4.1.3
- nixpkgs-unstable 4.1.3
- nixos-unstable-small 4.1.3
nixos-26.05 4.1.3
- nixos-26.05-small 4.1.3
- nixpkgs-26.05-darwin 4.1.3

pkgs.python313Packages.pytesseract

Python wrapper for Google Tesseract

nixos-unstable 0.3.13
- nixpkgs-unstable 0.3.13
- nixos-unstable-small 0.3.13
nixos-26.05 0.3.13
- nixos-26.05-small 0.3.13
- nixpkgs-26.05-darwin 0.3.13

pkgs.python314Packages.pytesseract

Python wrapper for Google Tesseract

nixos-unstable 0.3.13
- nixpkgs-unstable 0.3.13
- nixos-unstable-small 0.3.13
nixos-26.05 0.3.13
- nixos-26.05-small 0.3.13
- nixpkgs-26.05-darwin 0.3.13

pkgs.perlPackages.ImageOCRTesseract

Read an image with tesseract ocr and get output

nixos-unstable 1.26
- nixpkgs-unstable 1.26
- nixos-unstable-small 1.26
nixos-26.05 1.26
- nixos-26.05-small 1.26
- nixpkgs-26.05-darwin 1.26

pkgs.perl5Packages.ImageOCRTesseract

Read an image with tesseract ocr and get output

nixos-unstable 1.26
- nixpkgs-unstable 1.26
- nixos-unstable-small 1.26
nixos-26.05 1.26
- nixos-26.05-small 1.26
- nixpkgs-26.05-darwin 1.26

Package maintainers

@PatrickDaG Patrick <patrick-nixos@failmail.dev>

Nixpkgs security tracker

Details of issue NIXPKGS-2026-2407

References

Affected products

Matching in nixpkgs

pkgs.tesseract

pkgs.tesseract5

pkgs.tesseract3

pkgs.tesseract4

pkgs.python313Packages.pytesseract

pkgs.python314Packages.pytesseract

pkgs.perlPackages.ImageOCRTesseract

pkgs.perl5Packages.ImageOCRTesseract

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.tesseract

pkgs.tesseract5

pkgs.tesseract3

pkgs.tesseract4

pkgs.python313Packages.pytesseract

pkgs.python314Packages.pytesseract

pkgs.perlPackages.ImageOCRTesseract

pkgs.perl5Packages.ImageOCRTesseract

Package maintainers