{"affected":[{"product":"tesseract","source":"CNA: GitHub_M","vendor":"tesseract-ocr","versions":[{"status":"affected","version":"< 5.5.4"}]},{"ecosystem":"other","packageName":"tesseract","product":"tesseract","source":"GitHub GHSA-6xhq-wvww-6xfg","vendor":"","versions":[{"status":"affected","version":"<= 5.5.1","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-119340","cwes":["CWE-190","CWE-681"],"description":"Tesseract is an open source OCR engine. Prior to 5.5.4, GENERIC_2D_ARRAY::DeSerializeSize in src/ccstruct/matrix.h reads matrix dimensions as signed int32_t values and compares them only with UINT16_MAX, allowing negative values to reach ResizeNoInit. Negative dimensions or a 65535 by 65535 product can create inconsistent allocation state and later out-of-bounds accesses while loading a crafted traineddata file, causing denial of service. This issue is fixed in version 5.5.4.","epss":{"date":"2026-11-04","percentile":0.01938,"score":0.00121},"exploits":[],"kev":null,"metrics":[{"score":5.5,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},{"score":5.5,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793846602872,"publishedAt":1793391766387,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-6xhq-wvww-6xfg"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tesseract-ocr/tesseract/pull/4649"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tesseract-ocr/tesseract/commit/048e92378f1a34dcdaf94bc515c7552ac01f08ef"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tesseract-ocr/tesseract/commit/048e92378f1a34dcdaf94bc515c7552ac01f08ef"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tesseract-ocr/tesseract/pull/4649"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-6xhq-wvww-6xfg"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-6xhq-wvww-6xfg"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-6xhq-wvww-6xfg","text":"tesseract (other): GitHub reports patched versions 5.5.4. Check the advisory for the affected release branch.","url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-6xhq-wvww-6xfg"}],"revision":"35b4632defbc35e762fa436abd9ea1906018a9fa3c89ba3e443f02e75484cbc3","sources":[{"modifiedAt":1793846602872,"name":"CNA: GitHub_M","retrievedAt":1793848127065,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119340"},{"modifiedAt":1793646893030,"name":"NVD","retrievedAt":1793665688022,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119340"},{"modifiedAt":1793391727000,"name":"GitHub Security Advisories","retrievedAt":1793746209770,"url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-6xhq-wvww-6xfg"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793848154627,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-119340"}],"ssvc":{"assessedAt":1793846580457,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Tesseract: GENERIC_2D_ARRAY DeSerializeSize signed integer comparison bypass allows negative dimensions","updatedAt":1793848154627}