CVE-2026-119339: fallo de gravedad media en tesseract-ocr tesseract
Tesseract: Crafted LSTM model (`WeightMatrix` mode byte) triggers `ASSERT_HOST` abort in `WeightMatrix::DeSerializeOld` under `FAST_FLOAT` — Denial of Service
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.5epss 0.2%
Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FAST_FLOAT builds, DeSerializeOld invokes ASSERT_HOST instead of returning an error, so loading a crafted model through TessBaseAPI::Init terminates the process and causes denial of service. This issue is fixed in version 5.5.4.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Productos afectados
tesseract-ocr · tesseractCVEs relacionadas — tesseract-ocr tesseract
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-119341NONETesseract: File-controlled pointers still reach `delete` in ADAPT_CLASS_STRUCT destructorEPSS 0.3%CVE-2026-88052HIGHTesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronizationEPSS 0.2%CVE-2026-88053HIGHTesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddataEPSS 0.2%CVE-2026-88048HIGHTesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matrix dimension mismatchEPSS 0.2%CVE-2026-88051HIGHTesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fieldsEPSS 0.2%CVE-2026-88054MEDIUMTesseract: Denial of service via empty-stack dereference in Plumbing/Series at model loadEPSS 0.2%