CVE-2026-119340

MEDIUM 5.5

Tesseract: GENERIC_2D_ARRAY DeSerializeSize signed integer comparison bypass allows negative dimensions

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

Tesseract is an open source OCR engine. Prior to 5.5.4, GENERIC_2D_ARRAY::DeSerializeSize in src/ccstruct/matrix.h reads matrix dimensions as signed int32_t values and compares them only with UINT16_MAX, allowing negative values to reach ResizeNoInit. Negative dimensions or a 65535 by 65535 product can create inconsistent allocation state and later out-of-bounds accesses while loading a crafted traineddata file, causing denial of service. This issue is fixed in version 5.5.4.

CWE	CWE-190 CWE-681
Vendor	tesseract-ocr
Product	tesseract
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for tesseract-ocr tesseract

Be the first to know when new medium vulnerabilities affecting tesseract-ocr tesseract are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

tesseract-ocr / tesseract

< 5.5.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-6xhq-wvww-6xfg github.com: https://github.com/tesseract-ocr/tesseract/pull/4649 github.com: https://github.com/tesseract-ocr/tesseract/commit/048e92378f1a34dcdaf94bc515c7552ac01f08ef github.com: https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4