A critical heap out of bounds write vulnerability in Tesseract OCR versions 5.5.3 and earlier could allow an attacker to cause memory corruption or arbitrary code execution.

This vulnerability is an out of bounds write (CWE-787) occurring within the LSTM engine. A crafted NT_LSTM layer causes a mismatch between source sizing and time step counts, allowing an unauthenticated attacker to trigger heap corruption during the recognition process.

The CVSS score of 8.6 classifies this as a high severity vulnerability. Successful exploitation could lead to total system compromise, including unauthorized data access or complete application failure, which poses a significant risk to operational integrity and data confidentiality for environments processing untrusted image files.

Immediate Action: As no fixed release is currently available, users should restrict the use of Tesseract to process only trusted input files and monitor the Tesseract GitHub repository for the release of a patched version.

Proactive Monitoring: Security teams should monitor system logs for unusual crash patterns or unexpected process termination of applications utilizing the Tesseract library.

Compensating Controls: Implement memory protection mechanisms and run the OCR engine within a sandboxed or containerized environment with strictly limited privileges to contain potential memory corruption attempts.

Public Exploit Available: No (exploit_available: false)

Given the potential for controlled heap corruption, this vulnerability represents a significant risk to any infrastructure relying on Tesseract for automated document processing. Organizations should prioritize isolating instances of the affected software and move to update the library as soon as the vendor issues a security patch.