BYVoid OpenCC up to 1.1.9 MaxMatchSegmentation.cpp MaxMatchSegmentation heap-based overflow

Summaryinfo

A vulnerability labeled as critical has been found in BYVoid OpenCC up to 1.1.9. This issue affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. Such manipulation leads to heap-based overflow. This vulnerability is listed as CVE-2025-15536. The attack must be carried out locally. In addition, an exploit is available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in BYVoid OpenCC up to 1.1.9 and classified as critical. Affected by this issue is the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-15536. The exploitation is known to be easy. The attack needs to be approached locally. Technical details as well as a public exploit are known.

The exploit is available at github.com. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 297498 (Fedora 43 : opencc (2026-b627cd8944)), which helps to determine the existence of the flaw in a target environment.

Applying the patch 345c9a50ab07018f1b4439776bad78a0d40778ec is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at CNNVD (CNNVD-202601-2965), Tenable (297498) and EUVD (EUVD-2026-3183). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• BYVoid

Name

• OpenCC

Version

• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.1.5
• 1.1.6
• 1.1.7
• 1.1.8
• 1.1.9

License

• open-source

Website

• Product: https://github.com/BYVoid/OpenCC/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #733347: BYVoid OpenCC ver.1.1.9 and master-branch Heap-based Buffer Overflow (by Oneafter)

Once again VulDB remains the best source for vulnerability data.

Discussion