CVE-2026-119341CWE-763

Tesseract: File-controlled pointers still reach `delete` in ADAPT_CLASS_STRUCT destructor

published October 30, 2026

CVSS v3.1
0.0
EPSS
—
In the wild
Unconfirmed
What it is

Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT_CLASS_STRUCT from a pre-adapted-template .a file without neutralizing TempProtos and Config pointer fields before any destructor path. When the legacy engine is selected, classify_use_pre_adapted_templates is enabled, and an attacker can write the output-basename .a file, the success or rejection path can pass file-controlled pointers to ~ADAPT_CLASS_STRUCT and operator delete, causing memory corruption and denial of service. This issue is fixed in version 5.5.4.

The record
Technical detail
CVSS v3.1
0.0 · NONE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
CVSS v4.0
Not supplied
EPSS
Not scored
Weakness
CWE-763 · Release of Invalid Pointer or Reference
Published
2026-10-30T20:24Z
Timeline
  • 30 OCT 20:24Z
    Tesseract: File-controlled pointers still reach `delete` in ADAPT_CLASS_STRUCT destructor
    cvelistv5
  • 30 OCT 20:24Z
    Tesseract: File-controlled pointers still reach `delete` in ADAPT_CLASS_STRUCT destructor
    cvelistv5