Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-bounds write during OCR recognition. This issue is fixed in version 5.5.3.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:71566 advisory.

    A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was     among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005.

    Security Fix(es):

    * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:71568 advisory.

    A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was     among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005.

    Security Fix(es):

    * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:71567 advisory.

    A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was     among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005.

    Security Fix(es):

    * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:69495 advisory.

    A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was     among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005.

    Security Fix(es):

    * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:69111 advisory.

    A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was     among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005.

    Security Fix(es):

    * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1878:02 advisory.

    * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67831 advisory.

    * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67831 advisory.

    * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67830 advisory.

    * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67832 advisory.

    * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1866:01 advisory.

    * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1010 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-73066:
    Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded     through Tesseract's deserializer can cause an unchecked signed integer multiplication in     Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing     the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-     bounds write during OCR recognition. This issue is fixed in version 5.5.3.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-67830 advisory.

    [5.3.4-7]
    - Resolves: CVE-2026-73066

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-67832 advisory.

    [4.1.1-3]
    - Resolves: CVE-2026-73066

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-67831 advisory.

    [4.1.1-8]
    - Resolves: CVE-2026-73066

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67832 advisory.

    * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67831 advisory.

    A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was     among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005.

    Security Fix(es):

    * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67830 advisory.

    A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was     among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005.

    Security Fix(es):

    * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67832 advisory.

    A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was     among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005.

    Security Fix(es):

    * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded     through Tesseract's deserializer can cause an unchecked signed integer multiplication in     Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing     the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-     bounds write during OCR recognition. This issue is fixed in version 5.5.3. (CVE-2026-73066)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
349749	RHEL 10 : tesseract (RHSA-2026:71566)	Nessus	Red Hat Local Security Checks	Local	medium
349741	RHEL 9 : tesseract (RHSA-2026:71568)	Nessus	Red Hat Local Security Checks	Local	medium
349738	RHEL 9 : tesseract (RHSA-2026:71567)	Nessus	Red Hat Local Security Checks	Local	medium
348692	RHEL 8 : tesseract (RHSA-2026:69495)	Nessus	Red Hat Local Security Checks	Local	medium
348364	RHEL 8 : tesseract (RHSA-2026:69111)	Nessus	Red Hat Local Security Checks	Local	medium
348147	MiracleLinux 9 : tesseract-4.1.1-8.el9_8 (AXSA:2026-1878:02)	Nessus	Miracle Linux Local Security Checks	Local	medium
346864	AlmaLinux 9 : tesseract (ALSA-2026:67831)	Nessus	Alma Linux Local Security Checks	Local	medium
346850	RockyLinux 9 : tesseract (RLSA-2026:67831)	Nessus	Rocky Linux Local Security Checks	Local	medium
346843	RockyLinux 10 : tesseract (RLSA-2026:67830)	Nessus	Rocky Linux Local Security Checks	Local	medium
346837	RockyLinux 8 : tesseract (RLSA-2026:67832)	Nessus	Rocky Linux Local Security Checks	Local	medium
346822	MiracleLinux 8 : tesseract-4.1.1-3.el8_10 (AXSA:2026-1866:01)	Nessus	Miracle Linux Local Security Checks	Local	medium
346446	TencentOS Server 4: tesseract (TSSA-2026:1010)	Nessus	Tencent Local Security Checks	Local	medium
346422	Oracle Linux 10 : tesseract (ELSA-2026-67830)	Nessus	Oracle Linux Local Security Checks	Local	medium
346420	Oracle Linux 8 : tesseract (ELSA-2026-67832)	Nessus	Oracle Linux Local Security Checks	Local	medium
346419	Oracle Linux 9 : tesseract (ELSA-2026-67831)	Nessus	Oracle Linux Local Security Checks	Local	medium
346306	AlmaLinux 8 : tesseract (ALSA-2026:67832)	Nessus	Alma Linux Local Security Checks	Local	medium
346290	RHEL 9 : tesseract (RHSA-2026:67831)	Nessus	Red Hat Local Security Checks	Local	medium
346246	RHEL 10 : tesseract (RHSA-2026:67830)	Nessus	Red Hat Local Security Checks	Local	medium
346244	RHEL 8 : tesseract (RHSA-2026:67832)	Nessus	Red Hat Local Security Checks	Local	medium
334657	Linux Distros Unpatched Vulnerability : CVE-2026-73066	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-73066

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium