CVE-2026-119338CWE-125CWE-415CWE-416

Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages

Medium · published October 30, 2026

CVSS v4.0
6.9
EPSS
—
In the wild
Unconfirmed
What it is

Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewed_flag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
EPSS
Not scored
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-415 · Double Free; CWE-416 · Use After Free
Published
2026-10-30T20:12Z
Timeline
  • 30 OCT 20:12Z
    Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages
    cvelistv5
  • 30 OCT 20:12Z
    Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages
    cvelistv5