CVE-2026-73067

The heap out-of-bounds read in SquishedDawg::read_squished_dawg during TessBaseAPI::Init is being treated as a medium-severity denial-of-service issue, but the CVSS 6.7 rating badly mischaracterizes the actual risk. This is an information disclosure primitive, not merely a crash vector. When last_edge reads beyond the edges_ buffer, it can leak arbitrary heap contents — and because this triggers during model file loading rather than OCR processing, it fires in whatever process context Tesseract is embedded in. In shared-worker web services processing user uploads, adjacent heap allocations routinely contain session tokens, request metadata, or partial document data from other users. The heap doesn't randomize allocations — it clusters related objects, so the OOB read doesn't need precision to land on sensitive data in a long-running process. The root cause is a state machine parsing error: the DAWG reader assumes well-formed input and skips termination validation on forward-edge runs. This is the same pattern that has produced decades of parser vulnerabilities in archive and image libraries — a medium-rated CVE followed by variants from different malformed input paths six to eighteen months later. The question is whether the 5.5.3 patch adds a surgical bounds check that masks this specific case, or whether it restructures how the parser handles malformed input generally. If it's the former, treat this as the first of a family and expect similar issues in adjacent DAWG structures and .traineddata parsing routines. Defenders should treat this as an exposure-level risk, not an asset-level one. The same OOB read primitive is dramatically more dangerous in a containerized OCR microservice than in a CLI tool, and CVSS has no mechanism to capture that deployment context. Verify what version you're running, then examine the actual patch diff — a version bump alone doesn't confirm the architectural assumption was fixed. If you allow custom .traineddata uploads in any service, treat model loading as an untrusted input path and isolate it accordingly. The risk compounds over time as processes age and heap adjacency accumulates sensitive state.

Reviewed through automated stages and approved by a human before publication.