Vulnerability in Tesseract OCR Engine Affects Open Source Document Processing
CVE-2026-119338

6.9MEDIUM

Key Information:

Vendor

Tesseract-ocr

Status
Tesseract
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119338?

The Tesseract OCR engine, versions 5.4.0 through 5.5.4, contains a vulnerability in the AppendLinePolygon function that leads to a use after free condition. This issue occurs due to the mishandling of the caller-owned right-to-left Pta accumulator, which, when combined with specific flags on Hebrew or Arabic pages, can result in multiple reads and frees of a stale object. As a consequence, this flaw may allow corrupted data to affect subsequent polygon line calculations, presenting a potential risk in processing accuracy. The vulnerability was addressed in version 5.5.4.

Affected Version(s)

tesseract >= 5.4.0, < 5.5.4

References

https://github.com/tesseract-ocr/tesseract/security/advis...
x_refsource_CONFIRM
https://github.com/tesseract-ocr/tesseract/pull/4647
x_refsource_MISC
https://github.com/tesseract-ocr/tesseract/commit/fa52414...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.