Memory Allocation Flaw in Tesseract OCR Engine Could Lead to Denial of Service

CVE-2026-119340

What is CVE-2026-119340?

Tesseract, the open-source OCR (Optical Character Recognition) engine, has a vulnerability related to memory allocation. Specifically, in versions prior to 5.5.4, the function GENERIC_2D_ARRAY::DeSerializeSize in the src/ccstruct/matrix.h file mishandles the reading of matrix dimensions as signed int32_t values. This oversight permits negative values and dimensions exceeding 65535 to progress unchecked, culminating in flawed memory allocation, which could lead to out-of-bounds access when processing specially crafted traineddata files. This vulnerability has been addressed in version 5.5.4, underscoring the importance of keeping software up-to-date to mitigate such risks.

References