{"id":"CVE-2025-15536","aliases":["ALPINE-CVE-2025-15536","AZL-74768","AZL-74790","DEBIAN-CVE-2025-15536","EUVD-2026-3183","GHSA-5pr6-crvp-2j9f","OESA-2026-1209","OESA-2026-1210","OESA-2026-1211","OESA-2026-1212","OESA-2026-1213","SUSE-SU-2026:21553-1","UBUNTU-CVE-2025-15536","USN-7972-1","USN-7972-2","openSUSE-SU-2026:10102-1","openSUSE-SU-2026:20683-1"],"status":"published","title":"BYVoid OpenCC MaxMatchSegmentation.cpp MaxMatchSegmentation heap-based overflow","description":"A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00252,"percentile":0.16794,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-122","CWE-787"],"published":"2026-01-18T09:02:12Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"opencc","fixed_in":["1.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"opencc","fixed_in":["1.2.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"opencc","fixed_in":["1.1.9+ds1-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"opencc","fixed_in":["1.1.9+ds1-4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"opencc","fixed_in":["1.1.7-3.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"opencc","fixed_in":["1.1.7-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"opencc","fixed_in":["1.1.3-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"opencc","fixed_in":["1.1.7-3.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"opencc","fixed_in":["1.1.7-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"opencc","fixed_in":["1.0.4-5ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opencc","fixed_in":["1.0.5+git20190530-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"opencc","fixed_in":["1.1.3+ds1-3ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"opencc","fixed_in":["1.1.7+ds1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"opencc","fixed_in":["1.1.9+ds1-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"opencc","fixed_in":["1.2.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.9"},{"fixed":"1.2.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.1-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.6+ds1-1","1.1.6+ds1-2","1.1.7+ds1-1","1.1.8+ds1-1","1.1.8+ds1-1~exp1","1.1.8+ds1-2","1.1.8+ds1-3","1.1.9+ds1-1","1.1.9+ds1-1~exp1","1.1.9+ds1-2","1.1.9+ds1-3","1.1.9+ds1-3~exp1","1.1.9+ds1-4","1.2.0+ds1-1","1.2.0+ds1-1~exp1","1.2.0+ds1-1~exp2","1.3.0+ds1-1","1.3.0+ds1-1~exp1","1.3.0+ds1-2","1.3.1+ds1-1","1.3.1+ds1-2","1.3.1+ds1-3","1.4.1+ds1-1","1.4.1+ds1-1~exp1","1.4.1+ds1-1~exp2","1.4.1+ds1-1~exp3","1.4.1+ds1-2","1.4.1+ds1-3","1.4.1+ds1-4","1.4.1+ds1-5","1.4.1+ds1-6","1.4.1+ds1-7","1.4.1+ds1-8","1.4.2+ds1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.9+ds1-1+deb13u1"}]}],"versions":["1.1.9+ds1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.9+ds1-4"}]}],"versions":["1.1.9+ds1-1","1.1.9+ds1-2","1.1.9+ds1-3","1.1.9+ds1-3~exp1"]},{"source":"osv","ecosystem":"npm","package":"opencc","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.0"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.7-3.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.7-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.7-3.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.7-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.3-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-5ubuntu0.1~esm1"}]}],"versions":["1.0.4-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5+git20190530-1ubuntu0.1~esm1"}]}],"versions":["1.0.5-2","1.0.5+git20190530-1","1.0.5+git20190530-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3+ds1-3ubuntu3.1"}]}],"versions":["1.1.1+git20200624+ds2-10ubuntu3","1.1.3+ds1-3ubuntu2","1.1.3+ds1-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.7+ds1-1ubuntu0.1"}]}],"versions":["1.1.6+ds1-1","1.1.7+ds1-1","1.1.7+ds1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.9+ds1-2ubuntu0.1"}]}],"versions":["1.1.9+ds1-1build1","1.1.9+ds1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3+ds1-3ubuntu3.1"}]}],"versions":["1.1.1+git20200624+ds2-10ubuntu3","1.1.3+ds1-3ubuntu2","1.1.3+ds1-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.7+ds1-1ubuntu0.1"}]}],"versions":["1.1.6+ds1-1","1.1.7+ds1-1","1.1.7+ds1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.9+ds1-2ubuntu0.1"}]}],"versions":["1.1.9+ds1-1build1","1.1.9+ds1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-5ubuntu0.1~esm1"}]}],"versions":["1.0.4-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5+git20190530-1ubuntu0.1~esm1"}]}],"versions":["1.0.5-2","1.0.5+git20190530-1","1.0.5+git20190530-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1.1"}]}]}],"products":[{"vendor":"byvoid","product":"open_chinese_convert"},{"vendor":"byvoid","product":"opencc"}],"references":[{"url":"https://vuldb.com/?id.341708","tags":["vdb-entry","technical-description","Third Party Advisory","VDB Entry","advisory","web","report"]},{"url":"https://vuldb.com/?ctiid.341708","tags":["signature","permissions-required","Permissions Required","VDB Entry","report","web"]},{"url":"https://vuldb.com/?submit.733347","tags":["third-party-advisory","Exploit","Third Party Advisory","VDB Entry","advisory","web","report"]},{"url":"https://github.com/BYVoid/OpenCC/issues/997","tags":["issue-tracking","exploit","Exploit","Issue Tracking","Patch","report","web"]},{"url":"https://github.com/BYVoid/OpenCC/pull/1005","tags":["issue-tracking","Issue Tracking","Patch","report","web"]},{"url":"https://github.com/oneafter/1222/blob/main/repro","tags":["exploit","Product","evidence","web","report"]},{"url":"https://github.com/BYVoid/OpenCC/commit/345c9a50ab07018f1b4439776bad78a0d40778ec","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/BYVoid/OpenCC/","tags":["product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15536","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5pr6-crvp-2j9f"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-15536","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15536.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-15536","tags":["advisory"]},{"url":"https://github.com/BYVoid/OpenCC","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1209","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1210","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1211","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1212","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1213","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621553-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256930","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15536","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-15536","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15536","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7972-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7972-2","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-15536","title":"BYVoid OpenCC MaxMatchSegmentation.cpp MaxMatchSegmentation heap-based overflow","description":"A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-01-18T09:02:12.026Z","modified":"2026-02-23T08:37:24.565Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","level":"medium","assessor":"cna"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","level":"medium","assessor":"cna"},{"version":"2.0","score":4.3,"vector":"AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C","assessor":"cna"}],"cwes":["CWE-122","CWE-119"],"updated_at":"2026-11-02T14:32:37.351404Z"}],"euvd":[{"id":"EUVD-2026-3183","description":"A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-01-18T09:02:12Z","modified":"2026-02-23T08:37:24Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T19:48:34.555054Z"}],"ghsa":[{"id":"GHSA-5pr6-crvp-2j9f","title":"Open Chinese Convert has Out-of-bounds Write","description":"A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-01-18T09:30:27Z","modified":"2026-02-06T22:32:16Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:39:23.728882Z"}],"nvd":[{"id":"CVE-2025-15536","description":"A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-01-18T09:15:46.96Z","modified":"2026-06-17T08:37:58.633Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:L/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"secondary"}],"cwes":["CWE-119","CWE-122","CWE-787"],"updated_at":"2026-11-02T14:11:57.915063Z"}],"osv":[{"id":"ALPINE-CVE-2025-15536","description":"A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-01-18T09:15:46.96Z","modified":"2026-11-03T06:33:00.293423045Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"CVE-2025-15536","title":"BYVoid OpenCC MaxMatchSegmentation.cpp MaxMatchSegmentation heap-based overflow","description":"A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-01-18T09:02:12.026Z","modified":"2026-10-28T10:45:08.374391995Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-119","CWE-122"],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"DEBIAN-CVE-2025-15536","description":"A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-01-18T09:15:46.96Z","modified":"2026-09-01T20:05:42.012150566Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"GHSA-5pr6-crvp-2j9f","title":"Open Chinese Convert has Out-of-bounds Write","description":"A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-01-18T09:30:27Z","modified":"2026-02-22T23:26:19.355843Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"OESA-2026-1209","title":"opencc security update","description":"Opencc is for between Traditional Chinese and Simplified Chinese characters and phrases conversion library.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in BYVoid OpenCC up to 1.1.9 and classified as critical. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The exploit is available at github.com. It is declared as proof-of-concept. Applying the patch 345c9a50ab07018f1b4439776bad78a0d40778ec is able to eliminate this problem. The bugfix is ready for download at github.com.(CVE-2025-15536)","status":"published","published":"2026-01-23T11:10:14Z","modified":"2026-08-18T01:19:30.052918227Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1210","title":"opencc security update","description":"Opencc is for between Traditional Chinese and Simplified Chinese characters and phrases conversion library.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in BYVoid OpenCC up to 1.1.9 and classified as critical. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The exploit is available at github.com. It is declared as proof-of-concept. Applying the patch 345c9a50ab07018f1b4439776bad78a0d40778ec is able to eliminate this problem. The bugfix is ready for download at github.com.(CVE-2025-15536)","status":"published","published":"2026-01-23T11:10:14Z","modified":"2026-08-18T01:19:29.944711504Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1211","title":"opencc security update","description":"Opencc is for between Traditional Chinese and Simplified Chinese characters and phrases conversion library.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in BYVoid OpenCC up to 1.1.9 and classified as critical. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The exploit is available at github.com. It is declared as proof-of-concept. Applying the patch 345c9a50ab07018f1b4439776bad78a0d40778ec is able to eliminate this problem. The bugfix is ready for download at github.com.(CVE-2025-15536)","status":"published","published":"2026-01-23T11:10:14Z","modified":"2026-08-18T01:19:29.933184249Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1212","title":"opencc security update","description":"Opencc is for between Traditional Chinese and Simplified Chinese characters and phrases conversion library.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in BYVoid OpenCC up to 1.1.9 and classified as critical. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The exploit is available at github.com. It is declared as proof-of-concept. Applying the patch 345c9a50ab07018f1b4439776bad78a0d40778ec is able to eliminate this problem. The bugfix is ready for download at github.com.(CVE-2025-15536)","status":"published","published":"2026-01-23T11:10:14Z","modified":"2026-08-18T01:19:29.833658658Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1213","title":"opencc security update","description":"Opencc is for between Traditional Chinese and Simplified Chinese characters and phrases conversion library.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in BYVoid OpenCC up to 1.1.9 and classified as critical. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The exploit is available at github.com. It is declared as proof-of-concept. Applying the patch 345c9a50ab07018f1b4439776bad78a0d40778ec is able to eliminate this problem. The bugfix is ready for download at github.com.(CVE-2025-15536)","status":"published","published":"2026-01-23T11:10:14Z","modified":"2026-08-18T01:19:29.903933395Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"UBUNTU-CVE-2025-15536","description":"A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-01-18T09:15:00Z","modified":"2026-05-26T22:59:14.306467709Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"AZL-74768","title":"CVE-2025-15536 affecting package opencc 1.1.1-3","description":"A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-01-18T09:15:46Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-74790","title":"CVE-2025-15536 affecting package opencc 1.1.1-3","description":"A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-01-18T09:15:46Z","modified":"2026-04-21T04:38:47.87742Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"openSUSE-SU-2026:10102-1","title":"libopencc1_2-1.2.0-1.1 on GA media","description":"These are all security issues fixed in the libopencc1_2-1.2.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-27T00:00:00Z","modified":"2026-03-23T04:54:26.87167Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20683-1","title":"Security update for opencc","description":"This update for opencc fixes the following issues:\n\nUpdate to version 1.2.0.\n\nSecurity issues fixed:\n\n- CVE-2025-15536: specifically crafted string can lead to out-of-bounds read (bsc#1256930).\n\nOther updates and bugfixes:\n\n- Version 1.2.0:\n  * Fix the crash issue when reading configuration files.\n  * Add type definitions (Typing).\n  * Fix two out-of-bounds reading issues when handling truncated UTF-8 input.\n","status":"published","published":"2026-05-05T15:14:20Z","modified":"2026-05-07T08:47:44.981077Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21553-1","title":"Security update for opencc","description":"This update for opencc fixes the following issues:\n\nUpdate to version 1.2.0.\n\nSecurity issues fixed:\n\n- CVE-2025-15536: specifically crafted string can lead to out-of-bounds read (bsc#1256930).\n\nOther updates and bugfixes:\n\n- Version 1.2.0:\n  * Fix the crash issue when reading configuration files.\n  * Add type definitions (Typing).\n  * Fix two out-of-bounds reading issues when handling truncated UTF-8 input.\n","status":"published","published":"2026-05-05T15:31:13Z","modified":"2026-05-12T18:27:13.863827Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"USN-7972-1","title":"opencc vulnerability","description":"It was discovered that OpenCC incorrectly handled truncated UTF-8 input.\nAn attacker could possibly use this issue to cause OpenCC to crash,\nresulting in a denial of service.","status":"published","published":"2026-01-21T17:35:53Z","modified":"2026-04-27T18:34:10.074491Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-7972-2","title":"opencc vulnerability","description":"USN-7972-1 fixed a vulnerability in OpenCC. This update provides the\ncorresponding update for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that OpenCC incorrectly handled truncated UTF-8  input.\n An attacker could possibly use this issue to cause OpenCC to  crash,\n resulting in a denial of service.","status":"published","published":"2026-05-26T20:39:08Z","modified":"2026-05-26T22:59:14.376593443Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}