CVE-2026-119339 Tesseract is an open source OCR engine.

Medium 5.5 Published 30 Oct 2026 Updated 30 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-119339?

CVE-2026-119339 is a medium-severity vulnerability in tesseract-ocr tesseract, published on 30 Oct 2026.

Official description

Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FAST_FLOAT builds, DeSerializeOld invokes ASSERT_HOST instead of returning an error, so loading a crafted model through TessBaseAPI::Init terminates the process and causes denial of service. This issue is fixed in version 5.5.4.

Weakness: CWE-617, CWE-20

Which versions are affected by CVE-2026-119339?

How do I fix CVE-2026-119339?

Upgrade to a fixed version.

Is CVE-2026-119339 being exploited?

There is no known exploitation of CVE-2026-119339 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-119339, ECHO-acdf-44a6-a427, GHSA-h9g4-frjx-6cj3, UBUNTU-CVE-2026-119339.