CVE-2026-119341

The record

Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT_CLASS_STRUCT from a pre-adapted-template .a file without neutralizing TempProtos and Config pointer fields before any destructor path. When the legacy engine is selected, classify_use_pre_adapted_templates is enabled, and an attacker can write the output-basename .a file, the success or rejection path can pass file-controlled pointers to ~ADAPT_CLASS_STRUCT and operator delete, causing memory corruption and denial of service. This issue is fixed in version 5.5.4.

Affected packages

Related vulnerabilities

• CVE-2026-112893 Pillow is a Python imaging library. CWE-763
• CVE-2026-85850 Release of invalid pointer or reference in Windows Kernel allows an authorized attacker… CWE-763
• CVE-2026-85362 Release of invalid pointer or reference in Windows Management Instrumentation allows an… CWE-763
• CVE-2026-83908 Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to… CWE-763
• CVE-2026-83735 Release of invalid pointer or reference in Windows Kernel allows an authorized attacker… CWE-763
• CVE-2026-108133 Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows… CWE-763
• CVE-2026-98160 In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs… CWE-763
• CVE-2026-74860 A flaw was found in libxml2 with Python bindings enabled. CWE-763