CVE-2026-119341 is a vulnerability in the Tesseract OCR engine prior to version 5.5.4. It involves improper handling of pointers in the ReadAdaptedClass function when using pre-adapted templates, which can lead to memory corruption and denial of service. The issue is fixed in versions 5.5.3 and 5.5.4.
CVE-2026-119340 is an integer overflow or wraparound vulnerability in the Tesseract OCR engine prior to version 5.5.4. The flaw occurs in the GENERIC_2D_ARRAY::DeSerializeSize function, which reads matrix dimensions as signed 32-bit integers but only compares them against UINT16_MAX. This allows negative or excessively large dimension values to cause inconsistent memory allocation states, leading to out-of-bounds accesses when loading a crafted traineddata file. The issue can cause denial of service by crashing the application. The vulnerability is fixed in Tesseract version 5.5.4.
Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FAST_FLOAT builds, DeSerializeOld invokes ASSERT_HOST instead of returning an error, so loading a crafted model through TessBaseAPI::Init terminates the process and causes denial of service. This issue is fixed in version 5.5.4.
CVE-2026-119338 is a medium severity vulnerability in the Tesseract OCR engine versions 5.4.0 up to but not including 5.5.4. The flaw involves an out-of-bounds read and double free/use-after-free conditions in the AppendLinePolygon function when processing right-to-left text such as Hebrew or Arabic. This leads to corrupted coordinate data being used internally. The issue is fixed in version 5.5.4.
CVE-2026-88054 is an out-of-bounds read vulnerability in the tesseract-ocr engine versions 5.5.3 and earlier. It occurs when a crafted .traineddata model with a zero-length stack for certain network layers is processed, leading to a dereference of an invalid pointer and a deterministic crash causing denial of service. No patch or fixed release is currently available.
CVE-2026-88052 is a high-severity vulnerability in the open source OCR engine tesseract, affecting version 5.5.3 and earlier. The flaw arises from improper validation of an array index in the UNICHARSET::load_via_fgets function, where an unchecked index can lead to out-of-bounds writes during initialization. This can cause heap corruption, crashes, or potentially controlled memory corruption. No official fix or patched release is available as of the latest review.
CVE-2026-88051 is a high severity heap out-of-bounds write vulnerability in tesseract-ocr versions 5.5.3 and earlier. It arises from improper handling of the GenericVector::read callback in the OCR engine's .traineddata model parsing, allowing a crafted input to cause heap corruption or crashes. No official fix is available as of the latest review.
CVE-2026-88053 is a high-severity heap out-of-bounds write vulnerability in the open source OCR engine Tesseract, affecting version 5.5.3 and earlier. The flaw occurs in the Classify::ReadIntTemplates function when processing crafted .traineddata files, where certain counts are used as loop bounds without proper validation. This can lead to heap corruption, crashes, or potentially controlled memory corruption during legacy-classifier initialization before OCR processing starts. No official fix or patch is available as of the latest review.
CVE-2026-88048 is a high-severity vulnerability in the open source OCR engine Tesseract, affecting version 5.5.3 and earlier. The flaw arises from improper validation of deserialized layer scalars in the FullyConnected::DeSerialize function, leading to inconsistent dimensions used during matrix operations. This can cause heap out-of-bounds reads and writes, resulting in heap corruption, crashes, information disclosure, or potentially controlled memory corruption. No official fix or patch is available as of the latest review.
CVE-2026-88050 is an out-of-bounds write vulnerability in the tesseract-ocr engine versions 5.5.3 and earlier. It arises from improper handling of negative code values in the RecodedCharID::DeSerialize function, leading to an invalid index used in a size-zero vector. This causes a wild-address memory write that can crash the application or cause allocation failures. No official fix or patch is available as of the latest review.
CVE-2026-88049 is a high-severity heap out-of-bounds write vulnerability in the open source OCR engine tesseract, affecting version 5.5.3 and earlier. The flaw arises from insufficient bounds checking in certain functions handling LSTM network data, allowing a crafted NT_LSTM layer to cause heap corruption during recognition. This can lead to crashes or potentially controlled memory corruption. No official fix or patch is available as of the latest review.
Multiple stack and heap buffer overflow vulnerabilities exist in tesseract-ocr version 5.5.3 and earlier. These include a stack-based buffer overflow in Classify::ReadNormProtos, heap out-of-bounds read/write in FullyConnected::DeSerialize, unchecked heap writes in LSTM layers, and other memory corruption issues during parsing of crafted .traineddata files. These flaws can lead to denial of service, crashes, heap corruption, information disclosure, or potentially control-flow hijacking. No fixed releases are available as of the latest review.
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond edges_, causing a heap out-of-bounds read and process crash before image processing. This issue is fixed in version 5.5.3.
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-bounds write during OCR recognition. This issue is fixed in version 5.5.3.