MGASA-2026-0470

This is a security update. It fixes nine vulnerabilities in tesseract, the OCR (text recognition) engine. All nine can be triggered only by feeding tesseract a maliciously crafted input file: either a specially crafted recognition/language data file (.traineddata) or a crafted word-list file. Depending on the specific flaw, this can cause a crash (denial of service) or memory corruption. CVE-2026-73067: out-of-bounds read when loading a crafted word-list file. CVE-2026-73066: out-of-bounds write when loading a crafted recognition model file. CVE-2026-88047: stack buffer overflow when loading a crafted language-normalisation file. CVE-2026-88048: out-of-bounds read/write from a crafted neural-network layer in a recognition model file. CVE-2026-88049: out-of-bounds write from a crafted neural-network layer in a recognition model file. CVE-2026-88050: out-of-bounds write from invalid character-encoding values in a crafted recognition model file. CVE-2026-88051: out-of-bounds write when loading a malformed internal data structure from a crafted recognition model file. CVE-2026-88052: out-of-bounds write when loading a crafted character-set file. CVE-2026-88053: out-of-bounds write when loading a crafted legacy recognition template file. CVE-2026-88054: crash (denial of service) when loading a crafted recognition model with an empty internal network. The tesseract package is updated to version 5.5.3, which on its own fixes CVE-2026-73067 and CVE-2026-73066. The remaining seven issues (CVE-2026-88047 to CVE-2026-88054) are not yet fixed in any upstream release, so nine patches taken from upstream's main development branch are also applied. Reported by Tristan Madani (CVE-2026-88047) and Zhixi "Jace" Sun (CVE-2026-88048 to CVE-2026-88054); see the individual advisories below for full credits, including CVE-2026-73067 and CVE-2026-73066.