Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119338— Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages

Quick assessment

Affected
tesseract-ocr tesseract
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tesseract 是一款开源的光学字符识别（OCR）引擎。在版本 5.4.0 至 5.5.4 中， 文件中的 函数在按值接收由调用方拥有的从右向左（RTL）的 累加器时，会将其销毁，导致 和 成为悬空指针。在默认 PAGE XML 级别下，处理 upright（正向）的希伯来文或阿拉伯文页面时，若 中的 为 false，则会进入存在漏洞的调用路径；而 大于零则提供了一条替代路径。该漏洞导致程序反复读取并释放已失效的对象，从而引发双重释放（double free）和释放后使用（use-after-free）问题，并

CVSS 6.9 · Medium

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119338

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages
Source: CVE Program / CVE List V5
Vulnerability Description
Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewed_flag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
tesseract-ocr tesseract >= 5.4.0, < 5.5.4 -

II. Public POCs for CVE-2026-119338

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119338

请登录查看更多情报信息。

Other References for CVE-2026-119338 (4)

Same Patch Batch · tesseract-ocr · 2026-10-30 · 4 CVEs total

CVE-2026-119339 5.5 MEDIUM Tesseract: Crafted LSTM model (`WeightMatrix` mode byte) triggers `ASSERT_HOST` abort in `
CVE-2026-119340 5.5 MEDIUM Tesseract: GENERIC_2D_ARRAY DeSerializeSize signed integer comparison bypass allows negati
CVE-2026-119341 Tesseract: File-controlled pointers still reach `delete` in ADAPT_CLASS_STRUCT destructor

IV. Related Vulnerabilities

Same product: tesseract
Same vendor: tesseract-ocr
Same weakness: CWE-125