{"id":"CVE-2026-119338","aliases":[],"cve":{"records":[{"id":"CVE-2026-119338","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-29T20:44:30.286Z","published":"2026-10-30T20:12:29.030Z","modified":"2026-10-30T20:12:29.030Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T20:12:29.030Z"}],"references":[{"url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-vf7v-2h4f-6f4j","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/tesseract-ocr/tesseract/pull/4647","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/tesseract-ocr/tesseract/commit/fa52414ff1fd13ae4b00048d2498f9141b0bc2eb","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-125","description":"CWE-125: Out-of-bounds Read","source":"GitHub_M"},{"id":"CWE-415","description":"CWE-415: Double Free","source":"GitHub_M"},{"id":"CWE-416","description":"CWE-416: Use After Free","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"title":"Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewed_flag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4.","score":6.9,"severity":"medium","published":"2026-10-30T20:12:29.030Z","modified":"2026-10-30T20:12:29.030Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"tesseract-ocr","name":"tesseract","platforms":[],"versions":[{"version":">= 5.4.0, < 5.5.4","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-119338"}],"remediation":[],"references":["https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-vf7v-2h4f-6f4j","https://github.com/tesseract-ocr/tesseract/pull/4647","https://github.com/tesseract-ocr/tesseract/commit/fa52414ff1fd13ae4b00048d2498f9141b0bc2eb","https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4"],"sources":[{"name":"CVE","id":"CVE-2026-119338","modified":"2026-10-30T20:12:29.030Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119338"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","score":6.9}],"sourceAffected":[],"observedAt":"2026-10-30T21:23:32.716Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T10:00:31.629Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Tesseract versions 5.4.0 to 5.5.3 have a double free and use after free weakness in the PAGE XML renderer on right-to-left pages, potentially causing corrupted coordinates. The issue occurs when processing upright Hebrew or Arabic pages. It is fixed in version 5.5.4.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T05:06:05.173Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119338"}]}}