PT-2026-134184

CVE-2026-119338

Published

2026-10-30

Updated

2026-10-30

Description by

CVSS 4.0

6.9

Medium

MetricsAV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Tesseract versions 5.4.0 through 5.5.3

Description The AppendLinePolygon() function in src/api/pagerenderer.cpp destroys a caller-owned right-to-left Pta accumulator when it is received by value. This results in line top rtl pts and line bottom rtl pts becoming dangling pointers. When processing upright Hebrew or Arabic pages at the default PAGE XML level, the system enters these calls via POLYGONFLAG with a false skewed flag or via LEVELFLAG greater than zero. This leads to a double free and use after free (a condition where a program continues to use a pointer after it has been freed), allowing corrupted coordinates to reach RecalcPolygonline().

Recommendations Update to version 5.5.4.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-125: Out-of-bounds Read

CWE-415: Double Free

CWE-416: Use After Free

Related identifiers