Vulnerability · Published Oct 30, 2026 · Assigned by GitHub_M

CVE-2026-119339Tesseract: Crafted LSTM model (`WeightMatrix` mode byte) triggers `ASSERT_HOST` abort in `WeightMatrix::DeSerializeOld` under `FAST_FLOAT` — Denial of Service

Medium 5.5

In plain English

A medium-severity improper input validation in tesseract from tesseract-ocr. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.2%top 94.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FAST_FLOAT builds, DeSerializeOld invokes ASSERT_HOST instead of returning an error, so loading a crafted model through TessBaseAPI::Init terminates the process and causes denial of service. This issue is fixed in version 5.5.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	tesseract	no fix listed	DEBIAN-CVE-2026-119339
Debian:13	tesseract	no fix listed	DEBIAN-CVE-2026-119339
Debian:14	tesseract	no fix listed	DEBIAN-CVE-2026-119339
Ubuntu:26.10	tesseract	no fix listed	UBUNTU-CVE-2026-119339

Affected products (as reported)

Vendor	Product	Versions
tesseract-ocr	tesseract	< 5.5.4

Weakness: CWE-20, CWE-617 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-h9g4-frjx-6cj3 x_refsource_CONFIRM
https://github.com/tesseract-ocr/tesseract/pull/4657 x_refsource_MISC
https://github.com/tesseract-ocr/tesseract/commit/c053424327352b9d5180aa7540c1f9e67c64f27e x_refsource_MISC
https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4 x_refsource_MISC