UBUNTU-CVE-2026-119340: Medium severity ubuntu/tesseract vulnerability
Tesseract is an open source OCR engine. Prior to 5.5.4, GENERIC2DARRAY::DeSerializeSize in src/ccstruct/matrix.h reads matrix dimensions as signed int32t values and compares them only with UINT16MAX, allowing negative values to reach ResizeNoInit. Negative dimensions or a 65535 by 65535 product can create inconsistent allocation state and later out-of-bounds accesses while loading a crafted traineddata file, causing denial of service. This issue is fixed in version 5.5.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tesseractto a version that resolves this vulnerability.Fixed in 5.5.4
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running Tesseract versions prior to 5.5.4 are exposed when they load a crafted traineddata file. Exploitation is local and requires user interaction.
What does an attacker need to exploit it?
An attacker needs to cause Tesseract to load a malicious traineddata file containing negative matrix dimensions or dimensions whose product is 65535 by 65535. The issue can then lead to out-of-bounds accesses and denial of service.
Is there a fix available?
Yes. The issue is fixed in Tesseract version 5.5.4.