Skip to content
OpenAdvisories
High ALSA-2026:67831 1 CVE

Important: tesseract security update

Published Sep 16, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005.

Security Fix(es):

* tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 9 tesseract 4.1.1-8.el9_8
AlmaLinux · 9 tesseract-devel 4.1.1-8.el9_8

Vulnerabilities 1

  • Medium 6.8
    CVE-2026-73066

    Tesseract: Heap out-of-bounds write in LSTM Convolve layer via crafted .traineddata

    Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the conv…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-73066
  • report
    https://bugzilla.redhat.com/2514011
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-67831.html