CVE-2026-119340: Tesseract: GENERIC_2D_ARRAY DeSerializeSize signed integer comparison bypass allows negative dimensions

Q: What must an attacker provide to trigger the issue?

The attacker must cause Tesseract to load a crafted traineddata file containing negative matrix dimensions or dimensions whose product is 65535 by 65535. Exploitation requires local access and user interaction, according to the supplied vector.

Q: Which deployments are affected?

Tesseract versions prior to 5.5.4 are affected. The listed software includes Ubuntu and Debian Tesseract packages, but no package-specific fixed versions are provided.

Q: What is the impact of successful exploitation?

A crafted traineddata file can produce inconsistent allocation state and later out-of-bounds accesses, resulting in denial of service. The provided data does not indicate confidentiality or integrity impact.

Q: What should be done if patching is not immediately possible?

Avoid loading traineddata files from untrusted sources until Tesseract can be updated to 5.5.4 or later. This directly removes the crafted input needed to trigger the vulnerable deserialization path.

Published Oct 30, 2026

Updated

Tesseract is an open source OCR engine. Prior to 5.5.4, GENERIC2DARRAY::DeSerializeSize in src/ccstruct/matrix.h reads matrix dimensions as signed int32t values and compares them only with UINT16MAX, allowing negative values to reach ResizeNoInit. Negative dimensions or a 65535 by 65535 product can create inconsistent allocation state and later out-of-bounds accesses while loading a crafted traineddata file, causing denial of service. This issue is fixed in version 5.5.4.

Affected Software

12 affected components

debian/tesseract<=5.3.0-2, <=5.5.0-1, <=5.5.0-1.1

debian/tesseract*

ubuntu/tesseract*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tesseract to a version that resolves this vulnerability.
Fixed in 5.5.4

Event History

Oct 30, 2026

CVE Published

via MITRE·08:22 PM

Data Sourced

via MITRE·08:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·09:16 PM

Affected Software

Frequently Asked Questions

What must an attacker provide to trigger the issue?

The attacker must cause Tesseract to load a crafted traineddata file containing negative matrix dimensions or dimensions whose product is 65535 by 65535. Exploitation requires local access and user interaction, according to the supplied vector.

Which deployments are affected?

Tesseract versions prior to 5.5.4 are affected. The listed software includes Ubuntu and Debian Tesseract packages, but no package-specific fixed versions are provided.

What is the impact of successful exploitation?

A crafted traineddata file can produce inconsistent allocation state and later out-of-bounds accesses, resulting in denial of service. The provided data does not indicate confidentiality or integrity impact.

What should be done if patching is not immediately possible?

Avoid loading traineddata files from untrusted sources until Tesseract can be updated to 5.5.4 or later. This directly removes the crafted input needed to trigger the vulnerable deserialization path.

CVE-2026-119340: Tesseract: GENERIC_2D_ARRAY DeSerializeSize signed integer comparison bypass allows negative dimensions

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker provide to trigger the issue?

Which deployments are affected?

What is the impact of successful exploitation?

What should be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the issue?

Which deployments are affected?

What is the impact of successful exploitation?

What should be done if patching is not immediately possible?