{"affected":[{"product":"tesseract","source":"CNA: GitHub_M","vendor":"tesseract-ocr","versions":[{"status":"affected","version":">= 5.4.0, < 5.5.4"}]},{"ecosystem":"other","packageName":"tesseract","product":"tesseract","source":"GitHub GHSA-vf7v-2h4f-6f4j","vendor":"","versions":[{"status":"affected","version":">= 5.4.0, <= 5.5.3","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-119338","cwes":["CWE-125","CWE-415","CWE-416"],"description":"Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewed_flag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4.","epss":{"date":"2026-11-04","percentile":0.03205,"score":0.00138},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-vf7v-2h4f-6f4j"}],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":6.9,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1793846473497,"publishedAt":1793391149030,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-vf7v-2h4f-6f4j"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tesseract-ocr/tesseract/pull/4647"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tesseract-ocr/tesseract/commit/fa52414ff1fd13ae4b00048d2498f9141b0bc2eb"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-vf7v-2h4f-6f4j"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tesseract-ocr/tesseract/commit/fa52414ff1fd13ae4b00048d2498f9141b0bc2eb"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tesseract-ocr/tesseract/pull/4647"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-vf7v-2h4f-6f4j"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-vf7v-2h4f-6f4j"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-vf7v-2h4f-6f4j","text":"tesseract (other): GitHub reports patched versions 5.5.4. Check the advisory for the affected release branch.","url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-vf7v-2h4f-6f4j"}],"revision":"619d4854c502b22df858ac287d12b35b43b4e34f9bdbcbe1083290c7010aa2f8","sources":[{"modifiedAt":1793846473497,"name":"CNA: GitHub_M","retrievedAt":1793848124542,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119338"},{"modifiedAt":1793646893030,"name":"NVD","retrievedAt":1793665686198,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119338"},{"modifiedAt":1793391094000,"name":"GitHub Security Advisories","retrievedAt":1793745609549,"url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-vf7v-2h4f-6f4j"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793848154896,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-119338"}],"ssvc":{"assessedAt":1793846450309,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages","updatedAt":1793848154896}