Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2025-15536: OpenCC Chinese Converter Has Local Data Corruption Risk
CVE-2025-15536 · published 9 months ago
Summary
The OpenCC Chinese converter may allow an attacker to corrupt data on a local system. This is due to an issue in the converter's code. To protect your system, update OpenCC to the latest patched version.
What to do
- Update byvoid opencc to version 1.2.0.
- Update canonical opencc to version 1.1.3+ds1-3ubuntu3.1.
- Update debian opencc to version 1.1.9+ds1-1+deb13u1.
- Update debian opencc to version 1.1.9+ds1-4.
- Update canonical opencc to version 1.1.7+ds1-1ubuntu0.1.
- Update canonical opencc to version 1.1.9+ds1-2ubuntu0.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | byvoid | opencc |
<= 1.1.9 Fix: upgrade to 1.2.0
|
| – | byvoid | open_chinese_convert |
<= 1.1.9 cpe:2.3:a:byvoid:open_chinese_convert:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | opencc | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | opencc | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | opencc | All versions |
| Ubuntu:22.04:LTS | canonical | opencc |
< 1.1.3+ds1-3ubuntu3.1 Fix: upgrade to 1.1.3+ds1-3ubuntu3.1
|
| Debian:11 | debian | opencc | All versions |
| Debian:12 | debian | opencc | All versions |
| Debian:13 | debian | opencc |
< 1.1.9+ds1-1+deb13u1 Fix: upgrade to 1.1.9+ds1-1+deb13u1
|
| Debian:14 | debian | opencc |
< 1.1.9+ds1-4 Fix: upgrade to 1.1.9+ds1-4
|
| Ubuntu:24.04:LTS | canonical | opencc |
< 1.1.7+ds1-1ubuntu0.1 Fix: upgrade to 1.1.7+ds1-1ubuntu0.1
|
| Ubuntu:25.10 | canonical | opencc |
< 1.1.9+ds1-2ubuntu0.1 Fix: upgrade to 1.1.9+ds1-2ubuntu0.1
|
Original advisory text
BYVoid OpenCC MaxMatchSegmentation.cpp MaxMatchSegmentation heap-based overflow
A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.
References
- https://ubuntu.com/security/notices/USN-7972-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2025-15536 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-15536 Third Party Advisory
- https://github.com/advisories/GHSA-5pr6-crvp-2j9f
- https://github.com/BYVoid/OpenCC/ URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15536... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-15536 Vendor Advisory
- https://github.com/BYVoid/OpenCC/pull/1005 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2025-15536 Vendor Advisory
- https://github.com/BYVoid/OpenCC/commit/345c9a50ab07018f1b4439776bad78a0d40778ec Patch
- https://vuldb.com/?id.341708 Vendor Advisory
- https://vuldb.com/?submit.733347 Vendor Advisory
- https://github.com/BYVoid/OpenCC/issues/997 Third Party Advisory
- https://vuldb.com/?ctiid.341708 Third Party Advisory
- https://github.com/oneafter/1222/blob/main/repro Exploit
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-119Buffer Overflow
CWE-787Out-of-bounds Write
CWE-122Heap-based Buffer Overflow
Timeline
Published18 Jan 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-5pr6-crvp-2j9f · GHSA
CVE-2025-15536 · NVD
CVE-2025-15536 · OSV
UBUNTU-CVE-2025-15536 · OSV
DEBIAN-CVE-2025-15536 · OSV
Track software like this
Free during beta