CVE-2026-73066 is a heap out-of-bounds write in Tesseract's LSTM model deserializer, specifically in the Convolve::DeSerialize function. The vulnerability stems from a signed integer multiplication that wraps during deserialization of a .traineddata file, producing an undersized buffer allocation. Subsequent writes using the unwrapped (larger) count then overflow the undersized allocation, with the overflow magnitude proportional to the gap between the wrapped and unwrapped values.
This is a design-level failure, not an isolated implementation mistake. Tesseract accepts untrusted binary model files from arbitrary sources and uses parameters embedded in those files to size internal buffers. The entire security boundary rests on the correctness of bounds-checking code at every deserialization site — and the signed-integer wrap in Convolve::DeSerialize demonstrates how that pressure predictably produces failures. The fix in 5.5.3 adds a check at this site, but the architectural question is whether the broader deserialization subsystem has been systematically hardened or whether this is another per-site patch in a pattern that will surface elsewhere.
Defenders should verify their Tesseract version: 5.5.3 contains the patch. More importantly, audit any pipeline that ingests .traineddata files from untrusted sources — document scanners, OCR APIs, accessibility tooling, and content management systems that embed Tesseract all share the same attack surface. The LSTM forward pass runs in the same address space as the rest of the OCR pipeline, meaning exploitation of this vulnerability can access any data that process holds.
The long-tail risk is significant. The .traineddata ecosystem is fragmented, with hobbyist language packs and domain-specific models distributed through various channels and often left unupdated. Even after code-level patching, organizations running older model files remain exposed. Consider implementing model provenance verification and treating all externally-sourced model files as untrusted input requiring sandboxing until validated. The signed-integer arithmetic in other LSTM deserializers in Tesseract likely carries the same vulnerability class — treat the 5.5.3 patch as a data point about systemic risk, not a complete resolution.