Tesseract OCR versions 5.5.3 and earlier contain a heap out-of-bounds write vulnerability (CWE-787) in the GenericVector::read function located in src/ccutil/genericvector.h. The vulnerability occurs because the function reads the 'reserved' and 'size_used_' int32 fields from a .traineddata model without enforcing an upper bound or invariant check. The reserve(reserved) call allocates backing storage, but the subsequent callback loop writes 'size_used_' elements, which can exceed the allocated size if 'size_used_' is larger than 'reserved'. A maliciously crafted TESSDATA_INTTEMP component with version_id 4 or later can exploit this by setting 'reserved' to a small value and 'size_used_' to a large value during the fontinfo_table_.read call in src/classify/intproto.cpp, resulting in heap corruption, crashes, or potentially controlled memory corruption. No patch or fixed release is currently available.

Successful exploitation of this vulnerability can lead to heap corruption, application crashes, or potentially controlled memory corruption, which may be leveraged for arbitrary code execution or denial of service. The vulnerability requires processing a specially crafted .traineddata model file and local access to the vulnerable Tesseract OCR engine. The CVSS 4.0 score is 8.6 (high severity), reflecting the complexity and impact of the flaw.

As of the latest information, no official patch or fix is available for this vulnerability. Users should avoid processing untrusted or malicious .traineddata model files with affected versions of Tesseract. Monitor the vendor's advisory channels for updates and apply any future patches promptly once released.