CVE Watch2 de nov. de 2026

CVE-2026-119341

Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT_CLASS_STRUCT from a

CVSS

0.0

Sem CVSS

EPSS

0.3%

p19

KEV

—

Exploit Today

0-100

Publicado: 30 de out. de 2026 · Última mod.: 2 de nov. de 2026 · CWE-763

EPSS · 30d

0.3%EPSS · 30 dias0.3%

2026-10-312026-11-05

Descrição técnica

Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT_CLASS_STRUCT from a pre-adapted-template .a file without neutralizing TempProtos and Config pointer fields before any destructor path. When the legacy engine is selected, classify_use_pre_adapted_templates is enabled, and an attacker can write the output-basename .a file, the success or rejection path can pass file-controlled pointers to ~ADAPT_CLASS_STRUCT and operator delete, causing memory corruption and denial of service. This issue is fixed in version 5.5.4.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1128937.5 ALT

46.1%

——14Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.9d CVE-2026-689085.3 MÉD

39.3%

——12libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes sendNextReportEntrySegment to serialize the report, the function wraps rptIdBuf[130] as a temporary MmsValue and passes it to MmsValue_setVisibleString. The setter's resize path frees the stack-backed buffer, allowing a remote client to trigger an invalid free and server crash by writing the oversized RptID and then generating a report. This issue is fixed in version 1.6.2.20d CVE-2026-970118.8 ALT

58.0%

——17Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.21d CVE-2026-858507.8 ALT

27.3%

——8Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.7d CVE-2026-853627.0 ALT

16.1%

——5Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.9d CVE-2026-839087.0 ALT

22.8%

——7Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate privileges locally.8d