Live › vulnerability › CVE-2026-119338
Tesseract is an open source OCR engine used to read text from images. A crafted upright Hebrew or Arabic page can trigger a double free and use after free during PAGE XML output, which can corrupt memory and may let an attacker run code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 21:25 UTC. All times on this page are UTC.
Only deployments running Tesseract 5.4.0 through 5.5.4 that process upright Hebrew or Arabic pages and emit PAGE XML output with polygon or level flags enabled. Services that only run Tesseract on Latin-script text or plain text output are less exposed. Whether a crafted input can reach code execution is not stated in the sources.
No product ranges from the sources yet.
tesseract --version; versions from 5.4.0 up to but not including 5.5.4 are affected.5.5.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewed_flag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-119338")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.