Tesseract OCR is vulnerable to a stack-based buffer overflow that could allow for arbitrary code execution or system crashes when processing maliciously crafted data files.

The vulnerability exists in the Classify::ReadNormProtos function within src/classify/normmatch.cpp, where an unbounded read operation triggers a stack-based buffer overflow (CWE-121). An unauthenticated attacker providing a crafted .traineddata file can corrupt the stack during the initialization of the legacy engine.

This vulnerability poses a significant risk to the integrity and availability of systems utilizing the Tesseract OCR engine. Successful exploitation allows for a denial of service, potentially disrupting critical document processing workflows, or control-flow hijacking which could lead to unauthorized code execution. Given the CVSS score of 8.6, this flaw is categorized as high severity and requires immediate attention to prevent system compromise.

Immediate Action: As no fixed release is currently available, restrict access to the Tesseract engine to trusted users only and prevent the processing of untrusted or externally sourced .traineddata files.

Proactive Monitoring: Monitor system logs for unexpected crashes of the Tesseract process or signs of irregular memory usage patterns during the initialization phase of the OCR engine.

Compensating Controls: Utilize sandboxing or containerization technologies to isolate the Tesseract OCR process, ensuring that any potential exploit remains contained within a restricted environment with minimal system privileges.

Public Exploit Available: Unknown

Organizations relying on Tesseract OCR should prioritize the implementation of strict input validation for all .traineddata files. Until a formal patch is released by the vendor, treat all external OCR data sources as untrusted and ensure that the Tesseract process runs with the least privilege necessary to limit the impact of a potential control-flow hijacking attempt.