Denial of Service Vulnerability in Tesseract OCR Engine - Open Source Product
CVE-2026-119339
5.5MEDIUM
What is CVE-2026-119339?
The Tesseract OCR engine, an open-source optical character recognition tool, is susceptible to a denial of service attack due to a flaw in the handling of mode bytes from a trained data LSTM network. This vulnerability arises prior to version 5.5.4, where the WeightMatrix::DeSerialize function does not adequately validate the input. Specifically, when the kDoubleFlag is unchecked, the DeSerializeOld function executes an assertion rather than an error response in default FAST_FLOAT builds. Consequently, a crafted model file can lead to unexpected process termination, rendering the service unusable. This critical issue has been rectified in the 5.5.4 release of Tesseract.
Affected Version(s)
tesseract < 5.5.4