CVE-2026-119339

MEDIUM 5.5

Tesseract: Crafted LSTM model (`WeightMatrix` mode byte) triggers `ASSERT_HOST` abort in `WeightMatrix::DeSerializeOld` under `FAST_FLOAT` — Denial of Service

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FAST_FLOAT builds, DeSerializeOld invokes ASSERT_HOST instead of returning an error, so loading a crafted model through TessBaseAPI::Init terminates the process and causes denial of service. This issue is fixed in version 5.5.4.

CWE	CWE-20 CWE-617
Vendor	tesseract-ocr
Product	tesseract
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for tesseract-ocr tesseract

Be the first to know when new medium vulnerabilities affecting tesseract-ocr tesseract are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

tesseract-ocr / tesseract

< 5.5.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-h9g4-frjx-6cj3 github.com: https://github.com/tesseract-ocr/tesseract/pull/4657 github.com: https://github.com/tesseract-ocr/tesseract/commit/c053424327352b9d5180aa7540c1f9e67c64f27e github.com: https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4