UBUNTU-CVE-2026-119341: Low severity ubuntu/tesseract vulnerability
Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPTCLASSSTRUCT from a pre-adapted-template .a file without neutralizing TempProtos and Config pointer fields before any destructor path. When the legacy engine is selected, classifyusepreadaptedtemplates is enabled, and an attacker can write the output-basename .a file, the success or rejection path can pass file-controlled pointers to ~ADAPTCLASSSTRUCT and operator delete, causing memory corruption and denial of service. This issue is fixed in version 5.5.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tesseractto a version that resolves this vulnerability.Fixed in 5.5.4
Event History
Frequently Asked Questions
What conditions must be met for exploitation?
The legacy engine must be selected, classify_use_pre_adapted_templates must be enabled, and the attacker must be able to write the output-basename .a pre-adapted-template file. The vulnerable code then reads attacker-controlled pointer fields that may be used during cleanup.
Are default deployments affected?
The issue requires use of the legacy engine and enabled pre-adapted templates, so systems not using that combination are not exposed through the described path.
What is the impact if exploitation succeeds?
File-controlled pointers can reach ~ADAPT_CLASS_STRUCT and operator delete, causing memory corruption and denial of service. The provided data does not claim confidentiality or integrity impact.
What can be done if upgrading is not immediately possible?
Prevent untrusted parties from writing the output-basename .a file, and avoid the affected combination of the legacy engine with classify_use_pre_adapted_templates enabled.
How can I determine whether a system is vulnerable?
Check whether Tesseract is older than 5.5.4 and whether it uses the legacy engine with classify_use_pre_adapted_templates enabled. Also determine whether an untrusted actor can write the output-basename .a file.