I think it's appropriate linking directly to Kriesel's blog¹ or his talk, as that's about the scanner creating fake data and not about rce. Though technically it too is not an OCR bug as there's no ocr in JBIG2.

¹: http://www.dkriesel.com/en/blog/2013/0802_xerox-workcentres_...