Hi,

The following vulnerabilities were published for tesseract.

CVE-2026-73066[0]:
| Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted
| .traineddata LSTM model component loaded through Tesseract's
| deserializer can cause an unchecked signed integer multiplication in
| Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the
| convolution output-channel count, undersizing the forward-pass
| output buffer while writes use the unwrapped element count and
| causing a heap out-of-bounds write during OCR recognition. This
| issue is fixed in version 5.5.3.


CVE-2026-73067[1]:
| Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted
| .traineddata model loaded through TessBaseAPI::Init can cause
| SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an
| unterminated forward-edge run, after which SquishedDawg::Load calls
| num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond
| edges_, causing a heap out-of-bounds read and process crash before
| image processing. This issue is fixed in version 5.5.3.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-73066
https://www.cve.org/CVERecord?id=CVE-2026-73066
[1] https://security-tracker.debian.org/tracker/CVE-2026-73067
https://www.cve.org/CVERecord?id=CVE-2026-73067

Regards,
Salvatore