CVE-2026-73066: Oracle Linux 10 Tesseract Security Update (ELSA-2026-67830) — Patching and Detection Guide

Oracle has published ELSA-2026-67830, an Important-rated security advisory for Oracle Linux 10, shipping updated Tesseract RPMs to the Unbreakable Linux Network (ULN). The update addresses CVE-2026-73066 in the Tesseract OCR engine.

If you run Oracle Linux 10 — or any downstream rebuild that tracks OL10 errata — and you have Tesseract installed, you need to treat this as a priority patch. Tesseract rarely sits on a server by accident. It is almost always there because something is feeding it untrusted content: scanned invoices, uploaded PDFs converted to images, mail gateway attachments, e-discovery pipelines, medical records intake, or KYC document processing. That makes the attack surface here real and externally reachable in many environments.

The advisory itself is terse — updated RPMs, CVE reference, Important rating. That brevity is typical for Oracle Linux errata. What follows is the practitioner's breakdown: what Tesseract exposure actually looks like in production, how to think about exploitation risk, how to hunt for abuse of OCR pipelines, and exactly how to patch and verify.

Technical Analysis

Affected Products

Any OL10 system with the tesseract package installed is in scope. Also check for applications that bundle or statically link Tesseract rather than using the system RPM — container images, vendor appliances, and third-party document-processing software frequently ship their own copy, and those will not be fixed by this erratum.

Why Tesseract Is a Meaningful Target

Tesseract is a large C/C++ codebase that parses complex, attacker-controllable binary formats — TIFF, PNG, JPEG, and multi-page image structures — and then performs layout analysis and character recognition over that parsed data. Historically, vulnerabilities in OCR and image-parsing libraries follow a consistent pattern:

1. Memory corruption during image decoding or layout analysis — heap overflows, out-of-bounds reads/writes, use-after-free.
2. Trigger requires only that a crafted image is processed — no authentication, no user interaction beyond the document reaching the pipeline.
3. Code execution lands in the context of the service account running the OCR workload — often a web application backend, message queue worker, or document conversion daemon.

The exploitation chain a defender should model is therefore: crafted image file → upload/email/scan ingestion point → OCR worker processes the file → memory corruption → arbitrary code execution as the service user → post-exploitation (credential theft, lateral movement, persistence in the application tier).

The highest-risk deployments are the ones that process documents from outside the trust boundary: customer upload portals, email-to-OCR workflows, RPA bots scraping attachments, and shared scanning infrastructure.

Exploitation Status

As of publication, there are no confirmed reports of in-the-wild exploitation of CVE-2026-73066, and the CVE has not been added to the CISA Known Exploited Vulnerabilities catalog. Oracle's "Important" rating indicates a flaw with meaningful impact but typically requiring specific conditions to exploit — consistent with a crafted-image memory-safety bug rather than a trivial unauthenticated RCE.

Do not let the absence of a KEV entry drive your prioritization. OCR libraries sit directly on untrusted input paths, proof-of-concept development for image-parser bugs is fast once a patch diff is available, and the patch itself tells researchers exactly where to look. Patch before the PoC, not after.

Detection & Response

You cannot signature a malformed image reliably at the endpoint — but you can absolutely detect the consequences of successful exploitation. A compromised OCR worker behaves in ways that legitimate Tesseract usage never does. Tesseract is a batch processor: it reads an image, writes text, and exits. It does not spawn shells, it does not open network connections to the internet, and it does not write executables to disk. Any of those behaviors is a high-fidelity signal.

Sigma Rules

---
title: Tesseract Process Spawning Shell or Script Interpreter
id: 3f8a1c72-9d4b-4e67-bc12-5e7a8f90a123
status: experimental
description: Detects shells or script interpreters launched as a child of tesseract. Tesseract is a non-interactive OCR processor and should never spawn command interpreters. This behavior strongly indicates successful exploitation of an OCR parsing flaw such as CVE-2026-73066.
references:
  - https://linuxsecurity.com/advisories/oracle/oracle10-elsa-2026-67830-tesseract-important
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/06/12
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/tesseract'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python2'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection
falsepositives:
  - Wrapper scripts that invoke tesseract and are incorrectly logged as its parent (verify parent/child relationship)
level: high
---
title: Outbound Network Connection From Tesseract Process
id: 8c2e5b14-6a3d-4f18-9c27-d4e6b2a90751
status: experimental
description: Detects outbound network connections initiated by the tesseract binary. Tesseract performs purely local image-to-text processing and has no legitimate reason to initiate network connections. Connections to external hosts suggest command-and-control or data exfiltration following exploitation of an OCR parsing vulnerability such as CVE-2026-73066.
references:
  - https://linuxsecurity.com/advisories/oracle/oracle10-elsa-2026-67830-tesseract-important
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/06/12
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.exfiltration
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith: '/tesseract'
    Initiated: 'true'
  filter_localhost:
    DestinationIp:
      - '127.0.0.1'
      - '::1'
  condition: selection and not filter_localhost
falsepositives:
  - None expected in standard deployments; investigate all hits
level: critical

A note on tuning: rule one keys on the parent/child relationship, so it requires process creation logging with parent process data — auditd with the appropriate rules, eBPF-based telemetry, or an EDR agent. Plain syslog will not give you this. If your Linux estate lacks process lineage telemetry, that gap is itself worth fixing this quarter.

KQL (Microsoft Sentinel / Defender)

For environments ingesting Linux telemetry into Sentinel via Syslog/CEF or Defender for Endpoint onboarding, this hunt looks for tesseract spawning interpreters or establishing outbound connections, plus a version-inventory query to identify unpatched hosts.

// Hunt 1: Tesseract spawning shells, interpreters, or download tools
// Covers Syslog (auditd/execve), DeviceProcessEvents (MDE for Linux), and CommonSecurityLog (CEF EDR feeds)
union isfuzzy=true
    (DeviceProcessEvents
    | where InitiatingProcessFileName =~ "tesseract"
    | where FileName in~ ("sh", "bash", "dash", "zsh", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "socat")
    | project TimeGenerated=timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ReportId),
    (Syslog
    | where SyslogMessage has "tesseract" and SyslogMessage has_any ("/bin/sh", "/bin/bash", "python", "curl", "wget")
    | project TimeGenerated, Computer, HostName, SyslogMessage, SeverityLevel)
| extend SuspiciousChildProcess = coalesce(ProcessCommandLine, SyslogMessage)
| order by TimeGenerated desc;

// Hunt 2: Outbound network connections from tesseract (MDE for Linux)
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "tesseract"
| where not(RemoteIP startswith "127.")
| summarize FirstSeen=min(timestamp), LastSeen=max(timestamp), ConnectionCount=count(), RemoteEndpoints=make_set(RemoteIP, 20) by DeviceName, RemoteIP, RemotePort, InitiatingProcessCommandLine
| order by ConnectionCount desc;

// Hunt 3: Inventory — hosts with tesseract installed (via heartbeat/config ingestion or package telemetry)
// Adjust to your package inventory table if you forward rpm -qa output or use Defender Vulnerability Management
DeviceTvmSoftwareInventory
| where SoftwareName contains "tesseract"
| summarize Devices=make_set(DeviceName) by SoftwareName, SoftwareVersion
| order by SoftwareVersion asc;

Velociraptor VQL

For DFIR triage on a suspected host — for example, an OCR application server that crashed repeatedly before exhibiting odd behavior — this artifact enumerates tesseract processes, their children, and any sockets they hold.

-- Identify running tesseract processes, their children, and network sockets
-- Deploy as a hunt across OL10 document-processing servers
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)tesseract'
   OR CommandLine =~ '(?i)tesseract'

-- Correlate: any process whose parent is tesseract
LET tesseract_pids = SELECT Pid FROM pslist() WHERE Name =~ '(?i)tesseract'

SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid in (SELECT Pid FROM tesseract_pids)

-- Network connections held by tesseract (should be none)
SELECT Pid, Name, Status, LocalAddress, RemoteAddress
FROM netstat()
WHERE Name =~ '(?i)tesseract'

Remediation / Verification Script

The following Bash script inventories Tesseract exposure, applies the ELSA-2026-67830 update, verifies the installed version against the patched baseline, and identifies dependent services that need restarting. Run it on OL10 hosts (adapt the minimum version string to the exact build Oracle published once confirmed in your ULN channel).

#!/usr/bin/env bash
# ELSA-2026-67830 / CVE-2026-73066 - Tesseract remediation for Oracle Linux 10
# Run as root or via sudo. Test in staging before fleet rollout.

set -euo pipefail

echo "=== [1] Pre-patch inventory ==="
if rpm -q tesseract &>/dev/null; then
    CURRENT=$(rpm -q tesseract)
    echo "Installed: ${CURRENT}"
else
    echo "tesseract not installed via RPM - checking for bundled copies..."
    # Find statically bundled or non-RPM tesseract binaries (containers, vendor apps)
    find / -xdev -name "tesseract" -type f -executable 2>/dev/null | head -20
    echo "Review any binaries above - bundled copies are NOT fixed by this erratum."
fi

echo ""
echo "=== [2] Identify reverse dependencies (what will need restarting) ==="
rpm -q --whatrequires tesseract 2>/dev/null || echo "No RPM-level reverse dependencies."
# Identify running processes that have tesseract libraries mapped
lsof +D /usr/lib64 2>/dev/null | grep -i tesseract | awk '{print $1, $2}' | sort -u || true
fuser -v /usr/bin/tesseract 2>/dev/null || true

echo ""
echo "=== [3] Apply update from ULN/ol10 repos ==="
dnf clean all
dnf updateinfo list --cve CVE-2026-73066 2>/dev/null || true
dnf update -y tesseract
echo "Post-update version: $(rpm -q tesseract)"

echo ""
echo "=== [4] Verify patched build ==="
dnf updateinfo info --cve CVE-2026-73066 2>/dev/null | grep -A2 "Update ID" || \
    echo "Confirm ELSA-2026-67830 is listed as installed via: dnf updateinfo list --installed"

echo ""
echo "=== [5] Restart dependent services ==="
echo "Restart any OCR pipeline services, document-processing workers, or application"
echo "servers that link against tesseract libraries. Examples:"
echo "  systemctl restart <your-ocr-worker-service>"
echo "  systemctl restart <your-document-intake-service>"
echo "Long-running daemons keep the OLD library in memory until restarted -"
echo "patching alone does not remediate running processes."

echo ""
echo "=== [6] Post-patch health check ==="
tesseract --version | head -3
echo "Remediation complete. Log this host as patched for ELSA-2026-67830 / CVE-2026-73066."

Remediation

1. Patch immediately on internet-facing document pipelines. Apply ELSA-2026-67830 via dnf update tesseract on all OL10 systems. Pull from ULN or your synced ol10_appstream repository. Confirm the update with dnf updateinfo list --cve CVE-2026-73066.

2. Restart dependent services — this is the step people miss. The RPM update replaces files on disk, but any long-running daemon that has Tesseract libraries mapped continues running the vulnerable code until it is restarted. Identify dependents with lsof/fuser (see script above) and restart OCR workers, application servers, and queue consumers.

3. Hunt down bundled copies. Container images, vendor appliances, and third-party document-processing suites frequently ship their own Tesseract build. These are invisible to rpm and to this erratum. Inventory them (find / -name tesseract, container image scanning), and rebuild or update them from patched base images.

4. Segment OCR workloads. Treat any host that ingests untrusted documents as a high-risk zone: no outbound internet access for the OCR service account, dedicated service accounts with minimal privileges, and network policy restricting the pipeline tier to only its required upstream/downstream flows. If exploitation occurs, this is what converts a breach into an incident.

5. Deploy the detections above. A shell spawned by tesseract or an outbound connection from the tesseract binary is a near-zero-false-positive signal. Get process-lineage telemetry (auditd, eBPF, or EDR) onto your document-processing hosts if it is not there already.

6. Track CISA KEV. If CVE-2026-73066 is added to the KEV catalog, federal deadlines (typically 21 days for FCEB agencies under BOD 22-01) become a forcing function — and KEV inclusion means active exploitation, so your own window shrinks accordingly.

Official references: Oracle advisory ELSA-2026-67830 via LinuxSecurity and the Unbreakable Linux Network errata listing for your registered OL10 systems.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub