CVE-2026-119341

InfoCVSS 0.0/10Last modified Nov 2, 2026

Description

Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT_CLASS_STRUCT from a pre-adapted-template .a file without neutralizing TempProtos and Config pointer fields before any destructor path. When the legacy engine is selected, classify_use_pre_adapted_templates is enabled, and an attacker can write the output-basename .a file, the success or rejection path can pass file-controlled pointers to ~ADAPT_CLASS_STRUCT and operator delete, causing memory corruption and denial of service. This issue is fixed in version 5.5.4.

Metrics

CVSS 3.1 0.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

Weakness enumeration

CWE-763

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
tesseract-ocr	tesseract	< 5.5.3

References

Timeline

Published: Oct 30, 2026
Last modified: Nov 2, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1193425.3Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v CVE-2026-1193436.8Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/cre CVE-2026-1193449.1Cocos AI is a confidential computing system for AI. In version 0.8.2 and earlier, Cocos AI accepts trusted execution environment attestation CVE-2026-1193457.2Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection CVE-2026-119365.4IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain co CVE-2026-1193645.3ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP use CVE-2026-1193656.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Eleme CVE-2026-1193667.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz wpdiscuz allow CVE-2026-1193675.4Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configur CVE-2026-1193685.3Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configur CVE-2026-1193696.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Cale CVE-2026-119373.1IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container