{"id":"CVE-2026-119340","title":"Tesseract: GENERIC_2D_ARRAY DeSerializeSize signed integer comparison bypass allows negative dimensions","summary":"Tesseract is an open source OCR engine. Prior to 5.5.4, GENERIC_2D_ARRAY::DeSerializeSize in src/ccstruct/matrix.h reads matrix dimensions as signed int32_t values and compares them only with UINT16_MAX, allowing negative values to reach…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-190","CWE-681"],"vendor":"tesseract-ocr","product":"tesseract","affected":["tesseract < 5.5.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T02:43:00.457679Z"},"published":"2026-10-30","updated":"2026-11-05","sourceUpdated":"2026-11-05T02:43:22.872Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119340","references":[{"url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-6xhq-wvww-6xfg","label":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-6xhq-wvww-6xfg"},{"url":"https://github.com/tesseract-ocr/tesseract/pull/4649","label":"https://github.com/tesseract-ocr/tesseract/pull/4649"},{"url":"https://github.com/tesseract-ocr/tesseract/commit/048e92378f1a34dcdaf94bc515c7552ac01f08ef","label":"https://github.com/tesseract-ocr/tesseract/commit/048e92378f1a34dcdaf94bc515c7552ac01f08ef"},{"url":"https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4","label":"https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4"}],"tags":["cve.org"],"epss":0.00121,"epssPercentile":0.01938,"ingestedAt":"2026-11-05T21:36:00.712Z","slug":"CVE-2026-119340","body":"## Overview\n\nTesseract is an open source OCR engine. Prior to 5.5.4, GENERIC_2D_ARRAY::DeSerializeSize in src/ccstruct/matrix.h reads matrix dimensions as signed int32_t values and compares them only with UINT16_MAX, allowing negative values to reach ResizeNoInit. Negative dimensions or a 65535 by 65535 product can create inconsistent allocation state and later out-of-bounds accesses while loading a crafted traineddata file, causing denial of service. This issue is fixed in version 5.5.4.\n\n## Affected\n\n- `tesseract < 5.5.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}