CVE-2026-119340

Name of the Vulnerable Software and Affected Versions Tesseract versions prior to 5.5.4

Description The GENERIC 2D ARRAY::DeSerializeSize function in src/ccstruct/matrix.h reads matrix dimensions as signed int32 t values and compares them only with UINT16 MAX. This allows negative values to reach ResizeNoInit(). Negative dimensions or a product of 65535 by 65535 can create an inconsistent allocation state, leading to out-of-bounds accesses when loading a crafted traineddata file, which results in a denial of service.

Recommendations Update to version 5.5.4.