Request: enable Private Vulnerability Reporting / security contact

Current Behavior

Hi maintainers I've identified and reproduced a memory-safety vulnerability in Tesseract (confirmed on v5.5.2) and want to report it privately under coordinated disclosure. This repo has no SECURITY.md and Private Vulnerability Reporting isn't enabled, so I have no confidential channel. Could you either: (a) enable Settings → Code security → Private vulnerability reporting, so I can file a private advisory, or (b) point me to a confidential contact? I'll withhold all technical detail (file/line, PoC) until a private channel exists. I'm following coordinated disclosure and will agree a fix window before any public disclosure. Also I reported it via CVE MITRE. Thanks.

Loading a dictionary component from a crafted/malformed .traineddata file triggers an out-of-bounds memory access during model load, crashing the process (denial of service). It happens at load time, before any image is processed. (Exact location and a minimal reproducer withheld here for coordinated disclosure — I'll share them through a private channel.)

Expected Behavior

Untrusted dictionary data should be validated during loading and rejected gracefully (load fails with an error) instead of causing an out-of-bounds read or crashing.

Suggested Fix

Bounds-check the count/length fields read from the file before they're used to size allocations or index the loaded arrays, and reject inputs whose structure is inconsistent with the declared sizes

tesseract -v

No response

Operating System

No response

Other Operating System

No response

uname -a

No response

Compiler

No response

CPU

No response

Virtualization / Containers

No response

Other Information

No response