{"id":"CVE-2022-38266","aliases":["CLSA-2026-1784817741","CLSA-2026-1784970773","DEBIAN-CVE-2022-38266","DLA-3233-1","EUVD-2022-40858","GHSA-xgw2-h7jv-85pm","JLSEC-2026-210","MGASA-2022-0472","OESA-2023-1134","UBUNTU-CVE-2022-38266"],"status":"published","title":"An issue in the Leptonica linked library (v1.79.0) in Tesseract v5.0.0 allows attackers to cause...","description":"An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01559,"percentile":0.75538,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-369"],"published":"2022-09-09T00:00:00Z","modified":"2026-10-28T10:28:16Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"leptonica","fixed_in":["1.80.0-4.el9_2.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"leptonica-devel","fixed_in":["1.80.0-4.el9_2.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"leptonica-tools","fixed_in":["1.80.0-4.el9_2.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"leptonica","fixed_in":["1.80.0-4.el9.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"leptonica-devel","fixed_in":["1.80.0-4.el9.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"leptonica-tools","fixed_in":["1.80.0-4.el9.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"leptonlib","fixed_in":["1.82.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"leptonlib","fixed_in":["1.82.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"leptonlib","fixed_in":["1.82.0-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"leptonlib","fixed_in":["1.76.0-1+deb10u2"],"sources":["osv"]},{"ecosystem":"Julia","package":"Leptonica_jll","fixed_in":["1.81.1+0"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"leptonica","fixed_in":["1.81.0-1.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"mingw-leptonica","fixed_in":["1.81.0-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"leptonica","fixed_in":["1.79.0-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"leptonica","fixed_in":["1.79.0-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"leptonica","fixed_in":["1.79.0-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"leptonica","fixed_in":["1.79.0-3.oe2203sp1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"leptonica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.80.0-4.el9_2.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"leptonica-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.80.0-4.el9_2.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"leptonica-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.80.0-4.el9_2.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"leptonica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.80.0-4.el9.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"leptonica-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.80.0-4.el9.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"leptonica-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.80.0-4.el9.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"leptonlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.82.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"leptonlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.82.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"leptonlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.82.0-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"leptonlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.76.0-1+deb10u2"}]}],"versions":["1.76.0-1","1.76.0-1+deb10u1"]},{"source":"osv","ecosystem":"Julia","package":"Leptonica_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.81.1+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"leptonica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.81.0-1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"mingw-leptonica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.81.0-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"leptonica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.79.0-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"leptonica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.79.0-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"leptonica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.79.0-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"leptonica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.79.0-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"leptonlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.69-4ubuntu1","1.69-4ubuntu2","1.69-4ubuntu3","1.69-4ubuntu4","1.70.1-1","1.70.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tesseract","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.02.02-1","3.03.02-3","3.03.02-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"leptonlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.72-3","1.72-3build1","1.73-1","1.73-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tesseract","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.04.00-5ubuntu1","3.04.01-2","3.04.01-4","3.04.01-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"leptonlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.74.4-1","1.74.4-2","1.75.3-1","1.75.3-2","1.75.3-3","1.75.3-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tesseract","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.04.01-6","3.04.01-6build1","3.04.01-6build2","4.00~git2188-cdc35338-4build1","4.00~git2188-cdc35338-5","4.00~git2207-766b7bd6-3.1","4.00~git2219-40f43111-1.2","4.00~git2288-10f4998a-2","4.00~git2288-10f4998a-2ubuntu0.1~esm1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"leptonica","product":"leptonica"},{"vendor":"tesseract-ocr","product":"tesseract_ocr"}],"references":[{"url":"https://github.com/tesseract-ocr/tesseract/issues/3498","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/DanBloomberg/leptonica/commit/f062b42c0ea8dddebdc6a152fd16152de215d614","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00018.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://security.gentoo.org/glsa/202312-01","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38266","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xgw2-h7jv-85pm"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1784817741.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1784970773.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38266.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-38266","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0472.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31266","tags":["report"]},{"url":"https://www.debian.org/lts/security/2022/dla-3233","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1134","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-38266","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-38266","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-38266","description":"An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.","status":"published","published":"2022-09-09T00:00:00Z","modified":"2024-08-03T10:45:53.041Z","updated_at":"2026-11-02T14:34:37.599536Z"}],"euvd":[{"id":"EUVD-2022-40858","description":"An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.","status":"published","published":"2022-09-09T00:00:00Z","modified":"2024-08-03T10:45:53Z","updated_at":"2026-11-03T03:25:22.392967Z"}],"ghsa":[{"id":"GHSA-xgw2-h7jv-85pm","title":"An issue in the Leptonica linked library (v1.79.0) in Tesseract v5.0.0 allows attackers to cause...","description":"An issue in the Leptonica linked library (v1.79.0) in Tesseract v5.0.0 allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.","status":"published","published":"2022-09-10T00:00:22Z","modified":"2026-09-14T15:31:41Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T15:11:49.397809Z"}],"nvd":[{"id":"CVE-2022-38266","description":"An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.","status":"published","published":"2022-09-09T22:15:08.83Z","modified":"2026-09-14T14:10:44.773Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:07:27.631109Z"}],"osv":[{"id":"DEBIAN-CVE-2022-38266","description":"An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.","status":"published","published":"2022-09-09T22:15:08.83Z","modified":"2026-11-03T08:04:10.042551155Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:23:07.763774Z"},{"id":"JLSEC-2026-210","description":"An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.","status":"published","published":"2026-04-27T14:03:22.624Z","modified":"2026-07-18T00:00:34.839032668Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2023-1134","title":"leptonica security update","description":"The library supports many operations that are useful on\n\t\t* Document images\n\t\t* Natural images\n\t\tFundamental image processing and image analysis operations\n\t\t* Rasterop (aka bitblt)\n\t\t* Affine transforms (scaling, translation, rotation, shear)on images of arbitrary pixel depth\n\t\t* Projective and bi-linear transforms\n\t\t* Binary and gray scale morphology, rank order filters, and convolution\n\t\t* Seed-fill and connected components\n\t\t* Image transformations with changes in pixel depth, both at the same scale and with scale change\n\t\t* Pixelwise masking, blending, enhancement, arithmetic ops,etc.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.(CVE-2022-38266)","status":"published","published":"2023-03-04T11:05:36Z","modified":"2026-08-18T01:17:31.797412097Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2022-38266","description":"An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.","status":"published","published":"2022-09-09T22:15:00Z","modified":"2026-10-06T18:08:31.324824903Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"CLSA-2026-1784817741","title":"leptonica: Fix of CVE-2022-38266","description":"- CVE-2022-38266: prevent divide-by-zero errors in block convolution functions","status":"published","published":"2026-07-23T14:42:47Z","modified":"2026-10-26T09:30:28.397487863Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784970773","title":"leptonica: Fix of CVE-2022-38266","description":"- CVE-2022-38266: prevent divide-by-zero errors in block convolution functions","status":"published","published":"2026-07-25T09:13:04Z","modified":"2026-10-26T09:31:23.090567941Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CVE-2022-38266","description":"An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.","status":"published","published":"2022-09-09T00:00:00Z","modified":"2026-10-28T10:28:16.309968219Z","updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"DLA-3233-1","title":"leptonlib - security update","status":"published","published":"2022-12-08T00:00:00Z","modified":"2026-03-09T01:18:53.942184Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2022-0472","title":"Updated leptonica packages fix security vulnerability","description":"This update fixes a denial of service vulnerability in leptonlib. It can\nbe made to crash with an arithmetic exception on specially crafted JPEG\nfiles. (CVE-2022-38266)\n","status":"published","published":"2022-12-17T18:48:08Z","modified":"2026-04-16T04:42:41.642107803Z","updated_at":"2026-11-02T15:49:42.263076Z"}]}}