---
id: CVE-2026-119338
title: >-
  Tesseract: Double free and use after free in the PAGE XML renderer on
  right-to-left pages
summary: >-
  Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4,
  AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned
  right-to-left Pta accumulator while receiving it by value, leaving
  line_top_rtl_pts and line_bottom_r…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-125
  - CWE-415
  - CWE-416
vendor: tesseract-ocr
product: tesseract
affected:
  - 'tesseract >= 5.4.0, < 5.5.4'
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T02:40:50.309406Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T02:41:13.497Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119338'
references:
  - url: >-
      https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-vf7v-2h4f-6f4j
    label: >-
      https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-vf7v-2h4f-6f4j
  - url: 'https://github.com/tesseract-ocr/tesseract/pull/4647'
    label: 'https://github.com/tesseract-ocr/tesseract/pull/4647'
  - url: >-
      https://github.com/tesseract-ocr/tesseract/commit/fa52414ff1fd13ae4b00048d2498f9141b0bc2eb
    label: >-
      https://github.com/tesseract-ocr/tesseract/commit/fa52414ff1fd13ae4b00048d2498f9141b0bc2eb
  - url: 'https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4'
    label: 'https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4'
tags:
  - cve.org
  - exploit-available
epss: 0.00138
epssPercentile: 0.03205
ingestedAt: '2026-11-05T21:36:00.707Z'
---

## Overview

Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewed_flag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4.

## Affected

- `tesseract >= 5.4.0, < 5.5.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.