CVE-2025-15536
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Jan 18, 2026
CISA due date
—
The record
A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | opencc | 0 | 1.2.0 |
| openSUSE:Tumbleweed | opencc | 0 | 1.2.0-1.1 |
Related vulnerabilities
- GHSA-5pr6-crvp-2j9f Open Chinese Convert has Out-of-bounds Write Same vulnerability
- GHSA-7fqq-q52p-2jjg OpenCC has an Out-of-bounds read when processing truncated UTF-8 input Also affects opencc
- CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli… CWE-787
- CVE-2026-112397 Pillow is a Python imaging library. CWE-787
- CVE-2026-112059 libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point… CWE-787
- CVE-2026-89088 A flaw was found in parted. CWE-787
- CVE-2026-89085 A flaw was found in parted. CWE-787
- CVE-2026-85746 MariaDB server is a community developed fork of MySQL server. CWE-787