tesseract-ocr vulnerabilities

Newest CVEs

• CVE-2026-119341

  Tesseract: File-controlled pointers still reach `delete` in ADAPT_CLASS_STRUCT destructor

  tesseract-ocr · tesseract

  None0.0
• CVE-2026-119340

  Tesseract: GENERIC_2D_ARRAY DeSerializeSize signed integer comparison bypass allows negative dimensions

  tesseract-ocr · tesseract

  Medium5.5
• CVE-2026-119339

  Tesseract: Crafted LSTM model (`WeightMatrix` mode byte) triggers `ASSERT_HOST` abort in `WeightMatrix::DeSerializeOld` under `FAST_FLOAT` — Denial of Service

  tesseract-ocr · tesseract

  Medium5.5
• CVE-2026-119338

  Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages

  tesseract-ocr · tesseract

  Medium6.9
• CVE-2026-88054

  Tesseract: Denial of service via empty-stack dereference in Plumbing/Series at model load

  tesseract-ocr · tesseract

  Medium6.9
• CVE-2026-88053

  Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata

  tesseract-ocr · tesseract

  High8.6
• CVE-2026-88052

  Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization

  tesseract-ocr · tesseract

  High7.8
• CVE-2026-88051

  Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fields

  tesseract-ocr · tesseract

  High8.6
• CVE-2026-88050

  Tesseract: Out-of-bounds write in UnicharCompress via unvalidated recoder code values

  tesseract-ocr · tesseract

  Medium6.9
• CVE-2026-88049

  Tesseract: Heap out-of-bounds write in LSTM::Forward via na_/gate-matrix dimension mismatch

  tesseract-ocr · tesseract

  High8.6