0.0
NoneCVSS 3.1 · from GitHub_M
CVE-2026-119341
Tesseract: File-controlled pointers still reach `delete` in ADAPT_CLASS_STRUCT destructor
tesseract · CWE-763 · CWE-763Affectedtesseract
FixNo fix listed yet.
PublishedOct 30, 20:24 · GitHub_M
ScoredOct 30 · 0.0 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Description
Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT_CLASS_STRUCT from a pre-adapted-template .a file without neutralizing TempProtos and Config pointer fields before any destructor path. When the legacy engine is selected, classify_use_pre_adapted_templates is enabled, and an attacker can write the output-basename .a file, the success or rejection path can pass file-controlled pointers to ~ADAPT_CLASS_STRUCT and operator delete, causing memory corruption and denial of service. This issue is fixed in version 5.5.4.
From GitHub_M
Affected and fixed versions
ProductAffectedFixed intesseract< 5.5.3–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known