CVE-2026-119339 Tesseract: Crafted LSTM model (`WeightMatrix` mode byte) triggers `ASSERT_HOST` abort in `WeightMatrix::DeSerializeOld` under `FAST_FLOAT` — Denial of Service

Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FASTFLOAT builds, DeSerializeOld invokes ASSERTHOST instead of returning an error, so...

CVE-2026-119339

The Tesseract OCR engine is vulnerable to a Denial of Service (DoS) attack in versions prior to 5.5.4 . The issue resides in the WeightMatrix::DeSerialize function, which trusts a mode byte from a traineddata LSTM network. When the kDoubleFlag is clear, the system calls WeightMatrix::DeSerializeO...