CVE-2025-15536: Open Chinese Convert has Out-of-bounds Write
(updated )
A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.
References
- github.com/BYVoid/OpenCC
- github.com/BYVoid/OpenCC/commit/345c9a50ab07018f1b4439776bad78a0d40778ec
- github.com/BYVoid/OpenCC/issues/997
- github.com/BYVoid/OpenCC/pull/1005
- github.com/advisories/GHSA-5pr6-crvp-2j9f
- github.com/oneafter/1222/blob/main/repro
- nvd.nist.gov/vuln/detail/CVE-2025-15536
- vuldb.com/?ctiid.341708
- vuldb.com/?id.341708
- vuldb.com/?submit.733347
Code Behaviors & Features
Detect and mitigate CVE-2025-15536 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →