A critical heap out-of-bounds write vulnerability in the Tesseract OCR engine allows unauthenticated attackers to cause memory corruption or system crashes via a malicious traineddata file.

This vulnerability is an out-of-bounds write (CWE-787) occurring within the Classify::ReadIntTemplates function. An unauthenticated attacker can supply a specially crafted traineddata file to trigger heap corruption during the legacy-classifier initialization process.

Successful exploitation of this flaw could lead to a complete application crash or arbitrary memory corruption, which may be leveraged to achieve code execution. Given the CVSS score of 8.6, this represents a significant risk to systems processing untrusted OCR input, potentially compromising the integrity and availability of the host environment.

Immediate Action: As no fixed release is currently available, administrators should restrict the ability of the Tesseract engine to process files from untrusted or external sources.

Proactive Monitoring: Monitor system logs for unexpected Tesseract process terminations or segmentation faults, which may indicate attempted exploitation.

Compensating Controls: Utilize sandboxing technologies or containers with restricted privileges to execute Tesseract, effectively limiting the scope of impact should memory corruption occur.

Public Exploit Available: No (exploit_available: unknown)

This high-severity vulnerability poses a substantial risk to systems that utilize Tesseract for automated document processing. Security teams should prioritize isolating affected instances and monitoring for vendor updates. Once a patch is released, it must be deployed immediately to address the underlying memory safety issue and prevent potential exploitation.