Every CVE Search/ Get API key

CVE-2022-38266

An issue in the Leptonica linked library (v1.79.0) in Tesseract v5.0.0 allows attackers to cause...

6.5 MediumFix available

An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.55%Up 0.7 points since Sep 10, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.

Record
CVE-2022-38266
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-369
Updated
2026-11-02
CVE List No score

An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.

Record
CVE-2022-38266
Updated
2026-11-02
EUVDEUVD-2022-40858 No score

An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.

Record
EUVD-2022-40858
Updated
2026-11-03
GitHub AdvisoriesGHSA-xgw2-h7jv-85pm 6.5

An issue in the Leptonica linked library (v1.79.0) in Tesseract v5.0.0 allows attackers to cause...

An issue in the Leptonica linked library (v1.79.0) in Tesseract v5.0.0 allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.

Record
GHSA-xgw2-h7jv-85pm
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-369
Updated
2026-11-02
OSVDEBIAN-CVE-2022-38266 6.5

An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.

Record
DEBIAN-CVE-2022-38266
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVJLSEC-2026-210 6.5

An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.

Record
JLSEC-2026-210
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVOESA-2023-1134 6.5

leptonica security update

The library supports many operations that are useful on * Document images * Natural images Fundamental image processing and image analysis operations * Rasterop (aka bitblt) * Affine transforms (scaling, translation, rotation, shear)on images of arbitrary pixel depth * Projective and bi-linear transforms * Binary and gray scale morphology, rank order filters, and convolution * Seed-fill and connected components * Image transformations with changes in pixel depth, both at the same scale and with scale change * Pixelwise masking, blending, enhancement, arithmetic ops,etc.

Security Fix(es):

An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.(CVE-2022-38266)

Record
OESA-2023-1134
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-38266 6.5

An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.

Record
UBUNTU-CVE-2022-38266
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1784817741 No score

leptonica: Fix of CVE-2022-38266

  • CVE-2022-38266: prevent divide-by-zero errors in block convolution functions
Record
CLSA-2026-1784817741
Updated
2026-11-02
OSVCLSA-2026-1784970773 No score

leptonica: Fix of CVE-2022-38266

  • CVE-2022-38266: prevent divide-by-zero errors in block convolution functions
Record
CLSA-2026-1784970773
Updated
2026-11-02
OSV No score

An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.

Record
CVE-2022-38266
Updated
2026-11-02
OSVMGASA-2022-0472 No score

Updated leptonica packages fix security vulnerability

This update fixes a denial of service vulnerability in leptonlib. It can be made to crash with an arithmetic exception on specially crafted JPEG files. (CVE-2022-38266)

Record
MGASA-2022-0472
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
leptonica
TuxCare:AlmaLinux:9.2
 before 1.80.0-4.el9_2.1.tuxcare.els1
1.80.0-4.el9_2.1.tuxcare.els1
leptonica-devel
TuxCare:AlmaLinux:9.2
 before 1.80.0-4.el9_2.1.tuxcare.els1
1.80.0-4.el9_2.1.tuxcare.els1
leptonica-tools
TuxCare:AlmaLinux:9.2
 before 1.80.0-4.el9_2.1.tuxcare.els1
1.80.0-4.el9_2.1.tuxcare.els1
leptonica
TuxCare:AlmaLinux:9.6
 before 1.80.0-4.el9.1.tuxcare.els1
1.80.0-4.el9.1.tuxcare.els1
leptonica-devel
TuxCare:AlmaLinux:9.6
 before 1.80.0-4.el9.1.tuxcare.els1
1.80.0-4.el9.1.tuxcare.els1
leptonica-tools
TuxCare:AlmaLinux:9.6
 before 1.80.0-4.el9.1.tuxcare.els1
1.80.0-4.el9.1.tuxcare.els1
leptonlib
Debian:12
 before 1.82.0-1
1.82.0-1
leptonlib
Debian:13
 before 1.82.0-1
1.82.0-1
leptonlib
Debian:14
 before 1.82.0-1
1.82.0-1
leptonlib
Debian:10
 before 1.76.0-1+deb10u2, plus listed versions
1.76.0-11.76.0-1+deb10u1
1.76.0-1+deb10u2
Show 13 moreShow less
Affected packages
PackageAffectedFixed
Leptonica_jll
Julia
 before 1.81.1+0
1.81.1+0
leptonica
Mageia:8
 before 1.81.0-1.mga8
1.81.0-1.mga8
mingw-leptonica
Mageia:8
 before 1.81.0-1.mga8
1.81.0-1.mga8
leptonica
openEuler:20.03-LTS-SP1
 before 1.79.0-3.oe1
1.79.0-3.oe1
leptonica
openEuler:20.03-LTS-SP3
 before 1.79.0-3.oe1
1.79.0-3.oe1
leptonica
openEuler:22.03-LTS
 before 1.79.0-3.oe2203sp1
1.79.0-3.oe2203sp1
leptonica
openEuler:22.03-LTS-SP1
 before 1.79.0-3.oe2203sp1
1.79.0-3.oe2203sp1
leptonlib
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.69-4ubuntu11.69-4ubuntu21.69-4ubuntu31.69-4ubuntu41.70.1-11.70.1-1ubuntu0.1~esm1
 None known
tesseract
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.02.02-13.03.02-33.03.02-3ubuntu0.1~esm1
 None known
leptonlib
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.72-31.72-3build11.73-11.73-1ubuntu0.1~esm1
 None known
tesseract
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.04.00-5ubuntu13.04.01-23.04.01-43.04.01-4ubuntu0.1~esm1
 None known
leptonlib
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.74.4-11.74.4-21.75.3-11.75.3-21.75.3-31.75.3-3ubuntu0.1~esm1
 None known
tesseract
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.04.01-63.04.01-6build13.04.01-6build24.00~git2188-cdc35338-4build14.00~git2188-cdc35338-5
Show 4 moreShow less
4.00~git2207-766b7bd6-3.14.00~git2219-40f43111-1.24.00~git2288-10f4998a-24.00~git2288-10f4998a-2ubuntu0.1~esm1
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-38266 is a medium vulnerability (CVSS 6.5) in Leptonica, published September 9, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.55%, the 75th percentile. Fixed in leptonica 1.80.0-4.el9_2.1.tuxcare.els1.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open