Live › vulnerability › CVE-2026-119339
Tesseract is an open source OCR engine. A crafted traineddata model loaded through TessBaseAPI::Init triggers an assertion in default builds that terminates the process, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 21:25 UTC. All times on this page are UTC.
Applications that embed Tesseract and load traineddata language models supplied from outside the team, such as user uploads or downloaded models, are exposed. Systems that only load the models bundled with a trusted installation are less exposed. The sources do not say whether any particular distribution or package manager has shipped the fix.
No product ranges from the sources yet.
tesseract --version, and check any bundled or vendored copy in your application dependencies.5.5.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FAST_FLOAT builds, DeSerializeOld invokes ASSERT_HOST instead of returning an error, so loading a crafted model through TessBaseAPI::Init terminates the process and causes denial of service. This issue is fixed in version 5.5.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-119339")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.