CVE-2025-15536: OpenCC Package Suffers from Heap-based Buffer Overflow Vulnerability
Summary
CVE-2025-15536: Open Chinese Convert has Out-of-bounds Write. Affects opencc versions < 1.2.0. Fixed in 1.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open Chinese Convert (OpenCC) is an open-source project designed to facilitate the conversion between traditional and simplified Chinese characters. It is widely used in applications requiring language processing and text conversion. The package is available through the npm ecosystem, making it accessible for developers looking to integrate Chinese language support into their applications. However, versions up to 1.1.9 are vulnerable to a significant security flaw that could be exploited by local attackers.
Vulnerability Detail
A critical vulnerability has been identified in the BYVoid OpenCC package, specifically in the function opencc::MaxMatchSegmentation located in src/MaxMatchSegmentation.cpp. This flaw allows for an out-of-bounds write, leading to a heap-based buffer overflow. The vulnerability is limited to local execution, meaning that an attacker must have access to the local environment to exploit it. If successfully exploited, this could lead to unauthorized access to memory, potential data corruption, or execution of arbitrary code, posing a serious risk to the integrity and security of the affected system.
How To Fix
Latest published version: 1.4.2 as of 23 Oct 2026
npm install opencc@1.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.0
This is the first release that contains the fix.
npm install opencc@1.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch by updating to the latest version of the OpenCC package.
Conclusion
The OpenCC package has a significant vulnerability that could lead to severe security risks if not addressed. Users are strongly encouraged to update to version 1.2.0 or later to ensure their applications are secure. Utilizing tools like Vulert can help monitor for vulnerabilities in real-time, providing an additional layer of security.
See every vulnerability recorded for opencc →
FAQ
The vulnerability is an out-of-bounds write that leads to a heap-based buffer overflow, which can be exploited by local attackers.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your package-lock.json file, you can receive alerts about any vulnerabilities, including this one.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of severity.
Yes, a patch is available in version 1.2.0 of the OpenCC package. It is recommended to update to this version to mitigate the risk.
While there are no specific workarounds, it is crucial to prioritize updating the package as soon as possible to protect your application from potential exploits.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencc.
