CVE-2026-119338

Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages

State: Published
Severity: 6.9 Medium
Published: Oct 30, 2026
Updated: Oct 30, 2026
Reserved: Oct 29, 2026

Description

Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewed_flag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-125 Out-of-bounds Read
CWE-415 Double Free
CWE-416 Use After Free

Affected Products

Product	Versions
tesseracttesseract-ocr	>= 5.4.0, < 5.5.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.