UBUNTU-CVE-2026-119338: Use After Free
Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving linetoprtlpts and linebottomrtlpts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewedflag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tesseractto a version that resolves this vulnerability.Fixed in 5.5.4
Event History
Frequently Asked Questions
Which document-processing scenarios can trigger the issue?
The vulnerable path is reachable when processing an upright Hebrew or Arabic page at the default PAGE XML level, with POLYGONFLAG enabled and skewed_flag false. A LEVELFLAG value greater than zero is an alternative condition that can also gate access to the vulnerable calls.
What does an attacker need to do to exploit this?
An attacker would need to cause Tesseract to process input that reaches the affected PAGE XML polygon-rendering path. The vulnerability does not require privileges, but user interaction is indicated by the provided severity vector.
Are installations running the fixed release affected?
No. The issue is fixed in Tesseract version 5.5.4; the affected range is from 5.4.0 until 5.5.4.