# CVE-2026-119341: Tesseract unsafe pointer deserialization in adaptive templates

Source: https://junglewise.ai/threats/cve-2026-119341-tesseract-is-an-open-source-ocr-engine-prior-to-5-5-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119341 · Severity: info · CVSS 0 · Published 2026-10-30

Tesseract is an open-source optical character recognition (OCR) engine used to extract text from images and documents. When the legacy engine is enabled and an attacker can write to the pre-adapted-templates output file, malicious pointer values in that file can be passed to destructors, causing memory corruption and denial of service. This requires specific configuration and file-write access but could crash the application or enable further exploitation.

Technologies: [Tesseract OCR Tesseract](https://junglewise.ai/threats/technologies/tesseract). Vendors: [Tesseract OCR](https://junglewise.ai/threats/vendors/tesseract-ocr).

## Quick answers

**Is CVE-2026-119341 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119341 being exploited in the wild.

**How severe is CVE-2026-119341?** Informational severity, with a CVSS score of 0, published 30 October 2026.

**Which products and versions are affected?** Tesseract OCR Tesseract prior to 5.5.4.

**Is there a fix for CVE-2026-119341?** Yes: fixed in 5.5.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119341 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-119341?** Check whether you run Tesseract OCR Tesseract at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.5.4

## Technical details

ReadAdaptedClass in src/classify/adaptive.cpp performs a raw binary read of an ADAPT_CLASS_STRUCT from a .a file without sanitizing pointer fields (TempProtos and Config[] union members), leaving them holding attacker-controlled file bytes. The destructor unconditionally dereferences and deletes these pointers, enabling arbitrary pointer dereference and memory corruption. The vulnerability requires the legacy engine to be selected, classify_use_pre_adapted_templates enabled, and the attacker to write the output-basename .a file; it is fixed in version 5.5.4 by neutralizing pointer members immediately after deserialization.

## Affected products

- Tesseract OCR Tesseract prior to 5.5.4

## Timeline

- 2026-10-30: disclosed
- 2026-10-10: patched

## References

- [https://github.com/tesseract-ocr/tesseract/commit/614e971036d2b95d521057ff63d68d6612429b23](https://github.com/tesseract-ocr/tesseract/commit/614e971036d2b95d521057ff63d68d6612429b23)
- [https://github.com/tesseract-ocr/tesseract/pull/4645](https://github.com/tesseract-ocr/tesseract/pull/4645)

## Related threats

- [Tesseract matrix deserialization integer overflow denial of service](https://junglewise.ai/threats/cve-2026-119340-tesseract-is-an-open-source-ocr-engine-prior-to-5-5-4-generic-2d)
- [Tesseract empty network stack denial of service in model deserialization](https://junglewise.ai/threats/cve-2026-88054-tesseract-empty-network-stack-denial-of-service-in-model)
- [Tesseract OCR heap out-of-bounds write in inttemp deserialization](https://junglewise.ai/threats/cve-2026-88053-tesseract-ocr-heap-out-of-bounds-write-in-inttemp-deserialization)
- [Tesseract heap out-of-bounds write in UNICHARSET loading](https://junglewise.ai/threats/cve-2026-88052-tesseract-heap-out-of-bounds-write-in-unicharset-loading)
- [Tesseract heap out-of-bounds write in GenericVector::read](https://junglewise.ai/threats/cve-2026-88051-tesseract-heap-out-of-bounds-write-in-genericvector-read)