The tesseract-ocr update to version 5.5.3 fixes several security issues: CVE-2026-73067 involves a heap out-of-bounds read in SquishedDawg triggered by crafted models; CVE-2026-88047 is a stack buffer overflow in Classify::ReadNormProtos from crafted traineddata; CVE-2026-88048 and CVE-2026-88049 are heap out-of-bounds write/read errors caused by dimension mismatches in FullyConnected::Forward and LSTM::Forward respectively; CVE-2026-88050 involves out-of-bounds writes due to unvalidated recoder code values in UnicharCompress; CVE-2026-88051 and CVE-2026-88052 are heap out-of-bounds writes related to GenericVector<T>::read and UNICHARSET::load_via_fgets due to count or size desynchronizations; CVE-2026-88053 is a heap out-of-bounds write in Classify::ReadIntTemplates from unvalidated counts in crafted traineddata; CVE-2026-88054 causes denial of service via empty-stack dereference at model load. These vulnerabilities can lead to memory corruption or crashes when processing maliciously crafted OCR models or data.

These vulnerabilities can cause memory corruption including out-of-bounds reads and writes, stack buffer overflows, and denial of service conditions. Exploitation could lead to application crashes or potentially arbitrary code execution depending on the context, though no known exploits are reported. The flaws arise from improper validation of crafted OCR models and trained data inputs.

Update tesseract-ocr to version 5.5.3 or later, which includes fixes for all listed vulnerabilities. No additional mitigation is required once the update is applied.