DEBIAN-CVE-2026-119339: Medium severity debian/tesseract vulnerability

Published Oct 30, 2026

Updated

Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FASTFLOAT builds, DeSerializeOld invokes ASSERTHOST instead of returning an error, so loading a crafted model through TessBaseAPI::Init terminates the process and causes denial of service. This issue is fixed in version 5.5.4.

Affected Software

3 affected components

debian/tesseract*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tesseract to a version that resolves this vulnerability.
Fixed in 5.5.4

Event History

Oct 30, 2026

CVE Published

via OSV·09:16 PM

Data Sourced

via OSV·09:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Applications that use Tesseract and load traineddata LSTM network files through TessBaseAPI::Init are exposed if they run a version prior to 5.5.4 in a default FAST_FLOAT build. The impact is process termination, not confidentiality or integrity loss.

What must an attacker do to trigger the issue?

An attacker needs to cause the application to load a crafted traineddata model containing a mode byte with kDoubleFlag clear. User interaction is required according to the provided CVSS vector.

Are default builds affected?

Yes. The issue occurs in default FAST_FLOAT builds because the legacy deserialization path invokes ASSERT_HOST rather than returning an error.

What version contains the fix?

The issue is fixed in Tesseract version 5.5.4.

DEBIAN-CVE-2026-119339: Medium severity debian/tesseract vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What must an attacker do to trigger the issue?

Are default builds affected?

What version contains the fix?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What must an attacker do to trigger the issue?

Are default builds affected?

What version contains the fix?