CVE-2026-119339

Tesseract crafted LSTM model can abort its host process

Tesseract OCR · Tesseract LSTM model loader

First documented disclosure · Review checkpoint

Summary

An invalid LSTM weight-matrix format can terminate the process loading a model.

Severity and exploitation evidence

Medium · 5.5/10 · CVSS 3.1. Severity source.

Exploitation not established: Controlled research or code-path evidence; the reviewed sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A model-controlled mode byte selects an unimplemented legacy deserializer under the default FAST_FLOAT build; an assertion aborts the process instead of returning a loading error.

Conditions required

An application loads an attacker-controlled traineddata file or equivalent LSTM network data using an affected FAST_FLOAT build.

Potential impact

Denial of service of the model-loading process. The reviewed evidence does not establish code execution or an ordinary-image-only trigger.

Affected versions and configurations

Tesseract before 5.5.4, with FAST_FLOAT enabled (default).

Fix and mitigation status

5.5.4 fixes this assertion path; this is an issue-specific fix.

Practical next steps

Use a current supported fixed build, accept models from trusted sources, and isolate model loading so a malformed model cannot terminate the broader service.

Operating lesson

Model files are untrusted parser inputs even when they contain weights rather than executable scripts.

Evidence and limits

Public advisory and fix PR were October 20; 5.5.4 released October 28; CVE October 30. This is in scope because the affected path deserializes an LSTM model, not because AI assisted the researcher.

Sources