CVE-2026-119338: Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages
Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving linetoprtlpts and linebottomrtlpts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewedflag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tesseractto a version that resolves this vulnerability.Fixed in 5.5.4
Event History
Frequently Asked Questions
Which OCR workloads are exposed?
The vulnerable path is reached when rendering PAGE XML for upright right-to-left Hebrew or Arabic pages. At the default PAGE XML level, it requires POLYGONFLAG with skewed_flag set to false; LEVELFLAG greater than zero is an alternative gate.
Does exploitation require an authenticated user or direct interaction with the OCR process?
The vector is local, no privileges are required, and user interaction is required according to the supplied severity vector. The provided data does not specify the exact form of that interaction.
What is the remediation?
Upgrade Tesseract to version 5.5.4, which fixes the issue. The affected range is from 5.4.0 until 5.5.4.