CVE catalog

CVE-2025-15536

OpenCC vulnerability

Severity: Medium · CVSS 4.4CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Published: Jan 18, 2026, 9:15:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.25% · Oct 25, 2026

A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	opencc	sid	`1.4.2+ds1-1`	fixed
Debian	opencc	forky	`1.4.2+ds1-1`	fixed
Debian	opencc	trixie	`1.1.9+ds1-1+deb13u1`	fixed
Debian	opencc	bookworm	`1.1.6+ds1-1`	vulnerable
Ubuntu	opencc	noble	Not reported	vulnerable
Ubuntu	opencc	noble	`1.1.7+ds1-1ubuntu0.1`	fixed
Ubuntu	libopencc-data	noble	`1.1.7+ds1-1ubuntu0.1`	fixed
Ubuntu	libopencc-dev	noble	`1.1.7+ds1-1ubuntu0.1`	fixed
Ubuntu	libopencc-doc	noble	`1.1.7+ds1-1ubuntu0.1`	fixed
Ubuntu	libopencc1.1	noble	`1.1.7+ds1-1ubuntu0.1`	fixed
Ubuntu	opencc	pro	`1.0.5-2`	vulnerable
Ubuntu	opencc	pro	`1.0.5+git20190530-1`	vulnerable
Ubuntu	opencc	pro	`1.0.5+git20190530-1build1`	vulnerable
Ubuntu	opencc	pro	`1.0.5+git20190530-1ubuntu0.1~esm1`	fixed
Ubuntu	opencc	16.04	`0.4.3-2build1`	vulnerable
Ubuntu	opencc	pro	`1.0.5-2`	vulnerable
Ubuntu	opencc	pro	`1.0.5+git20190530-1`	vulnerable
Ubuntu	opencc	pro	`1.0.5+git20190530-1build1`	vulnerable
Ubuntu	opencc	pro	`1.0.5+git20190530-1ubuntu0.1~esm1`	fixed
Ubuntu	opencc	22.04	`1.1.1+git20200624+ds2-10ubuntu3`	vulnerable
Ubuntu	opencc	22.04	`1.1.3+ds1-3ubuntu2`	vulnerable
Ubuntu	opencc	22.04	`1.1.3+ds1-3ubuntu3`	vulnerable
Ubuntu	opencc	22.04	`1.1.3+ds1-3ubuntu3.1`	fixed
Ubuntu	opencc	24.04	`1.1.6+ds1-1`	vulnerable
Ubuntu	opencc	24.04	`1.1.7+ds1-1`	vulnerable
Ubuntu	opencc	24.04	`1.1.7+ds1-1build1`	vulnerable
Ubuntu	opencc	24.04	`1.1.7+ds1-1ubuntu0.1`	fixed
Ubuntu	opencc	25.10	`1.1.9+ds1-1build1`	vulnerable
Ubuntu	opencc	25.10	`1.1.9+ds1-2`	vulnerable
Ubuntu	opencc	25.10	`1.1.9+ds1-2ubuntu0.1`	fixed
Ubuntu	opencc	22.04	`1.1.1+git20200624+ds2-10ubuntu3`	vulnerable
Ubuntu	opencc	22.04	`1.1.3+ds1-3ubuntu2`	vulnerable
Ubuntu	opencc	22.04	`1.1.3+ds1-3ubuntu3`	vulnerable
Ubuntu	opencc	22.04	`1.1.3+ds1-3ubuntu3.1`	fixed
Ubuntu	opencc	24.04	`1.1.6+ds1-1`	vulnerable
Ubuntu	opencc	24.04	`1.1.7+ds1-1`	vulnerable
Ubuntu	opencc	24.04	`1.1.7+ds1-1build1`	vulnerable
Ubuntu	opencc	24.04	`1.1.7+ds1-1ubuntu0.1`	fixed
Ubuntu	opencc	25.10	`1.1.9+ds1-1build1`	vulnerable
Ubuntu	opencc	25.10	`1.1.9+ds1-2`	vulnerable
Ubuntu	opencc	25.10	`1.1.9+ds1-2ubuntu0.1`	fixed
Opensuse	opencc	tumbleweed	`1.2.0-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	opencc	source	sid	`1.1.9+ds1-4`	not yet assigned	Not reported	[1126286]
Debian	opencc	source	forky	`1.1.9+ds1-4`	not yet assigned	Not reported	[1126286]
Debian	opencc	source	trixie	`1.1.9+ds1-1+deb13u1`	not yet assigned	Not reported	[1126286]
Debian	opencc	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1126286]
Ubuntu	opencc	deb	noble	`1.1.7+ds1-1ubuntu0.1`	Not reported	Not reported	Not reported
Ubuntu	libopencc-data	deb	noble	`1.1.7+ds1-1ubuntu0.1`	Not reported	Not reported	Not reported
Ubuntu	libopencc-dev	deb	noble	`1.1.7+ds1-1ubuntu0.1`	Not reported	Not reported	Not reported
Ubuntu	libopencc-doc	deb	noble	`1.1.7+ds1-1ubuntu0.1`	Not reported	Not reported	Not reported
Ubuntu	libopencc1.1	deb	noble	`1.1.7+ds1-1ubuntu0.1`	Not reported	Not reported	Not reported
Ubuntu	opencc	deb	pro	`1.0.5+git20190530-1ubuntu0.1~esm1`	Not reported	USN-7972-2	Not reported
Ubuntu	opencc	deb	pro	`1.0.5+git20190530-1ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2025-15536	Not reported
Ubuntu	opencc	deb	22.04	`1.1.3+ds1-3ubuntu3.1`	Not reported	UBUNTU-CVE-2025-15536	Not reported
Ubuntu	opencc	deb	24.04	`1.1.7+ds1-1ubuntu0.1`	Not reported	UBUNTU-CVE-2025-15536	Not reported
Ubuntu	opencc	deb	25.10	`1.1.9+ds1-2ubuntu0.1`	Not reported	UBUNTU-CVE-2025-15536	Not reported
Ubuntu	opencc	deb	22.04	`1.1.3+ds1-3ubuntu3.1`	Not reported	USN-7972-1	Not reported
Ubuntu	opencc	deb	24.04	`1.1.7+ds1-1ubuntu0.1`	Not reported	USN-7972-1	Not reported
Ubuntu	opencc	deb	25.10	`1.1.9+ds1-2ubuntu0.1`	Not reported	USN-7972-1	Not reported
Opensuse	opencc	rpm	tumbleweed	`1.2.0-1.1`	Not reported	OPENSUSE-SU-2026:10102-1	Not reported

[Debian bug #1126286]

Notes

[bookworm] opencc: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libopencc1.1]Affected
Source package: [opencc]
Details (2)
- 1.1.6+ds1-1 · amd64 · bookworm
  Affected
  usn · opencc · debian · bookworm; usn · opencc · debian · 12
- 1.1.6+ds1-1 · arm64 · bookworm
  Affected
  usn · opencc · debian · bookworm; usn · opencc · debian · 12
[libopencc-data]Affected
Source package: [opencc]
Details (2)
- 1.1.6+ds1-1 · all · bookworm
  Affected
  usn · opencc · debian · bookworm; usn · opencc · debian · 12
- 1.1.6+ds1-1 · all · bookworm
  Affected
  usn · opencc · debian · bookworm; usn · opencc · debian · 12
[libopencc-dev]Affected
Source package: [opencc]
Details (2)
- 1.1.6+ds1-1 · amd64 · bookworm
  Affected
  usn · opencc · debian · bookworm; usn · opencc · debian · 12
- 1.1.6+ds1-1 · arm64 · bookworm
  Affected
  usn · opencc · debian · bookworm; usn · opencc · debian · 12
[libopencc-doc]Affected
Source package: [opencc]
Details (2)
- 1.1.6+ds1-1 · all · bookworm
  Affected
  usn · opencc · debian · bookworm; usn · opencc · debian · 12
- 1.1.6+ds1-1 · all · bookworm
  Affected
  usn · opencc · debian · bookworm; usn · opencc · debian · 12
[opencc]Affected
Details (2)
- 1.1.6+ds1-1 · amd64 · bookworm
  Affected
  usn · opencc · debian · bookworm; usn · opencc · debian · 12
- 1.1.6+ds1-1 · arm64 · bookworm
  Affected
  usn · opencc · debian · bookworm; usn · opencc · debian · 12

[openSUSE Tumbleweed]

[libopencc1_2]Unknown
Source package: [opencc]
Details (1)
- 1.2.0-1.6 · x86_64 · tumbleweed
  Unknown · Fixed: 1.2.0-1.1
  Version impact unknown
  usn · opencc · opensuse · tumbleweed
[opencc-data]Unknown
Source package: [opencc]
Details (1)
- 1.2.0-1.6 · x86_64 · tumbleweed
  Unknown · Fixed: 1.2.0-1.1
  Version impact unknown
  usn · opencc · opensuse · tumbleweed
[opencc-devel]Unknown
Source package: [opencc]
Details (1)
- 1.2.0-1.6 · x86_64 · tumbleweed
  Unknown · Fixed: 1.2.0-1.1
  Version impact unknown
  usn · opencc · opensuse · tumbleweed
[opencc]Fixed
Source package: [opencc]
Details (1)
- 1.2.0-1.6 · x86_64 · tumbleweed
  Fixed · Fixed: 1.2.0-1.1
  usn · opencc · opensuse · tumbleweed

[Debian 13 (Trixie)]

[libopencc1.1]Fixed
Source package: [opencc]
Details (2)
- 1.1.9+ds1-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.1.9+ds1-1+deb13u1
  usn · opencc · debian · 13
- 1.1.9+ds1-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.1.9+ds1-1+deb13u1
  usn · opencc · debian · 13
[libopencc-data]Fixed
Source package: [opencc]
Details (2)
- 1.1.9+ds1-1+deb13u1 · all · trixie
  Fixed · Fixed: 1.1.9+ds1-1+deb13u1
  usn · opencc · debian · 13
- 1.1.9+ds1-1+deb13u1 · all · trixie
  Fixed · Fixed: 1.1.9+ds1-1+deb13u1
  usn · opencc · debian · 13
[libopencc-dev]Fixed
Source package: [opencc]
Details (2)
- 1.1.9+ds1-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.1.9+ds1-1+deb13u1
  usn · opencc · debian · 13
- 1.1.9+ds1-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.1.9+ds1-1+deb13u1
  usn · opencc · debian · 13
[libopencc-doc]Fixed
Source package: [opencc]
Details (2)
- 1.1.9+ds1-1+deb13u1 · all · trixie
  Fixed · Fixed: 1.1.9+ds1-1+deb13u1
  usn · opencc · debian · 13
- 1.1.9+ds1-1+deb13u1 · all · trixie
  Fixed · Fixed: 1.1.9+ds1-1+deb13u1
  usn · opencc · debian · 13
[opencc]Fixed
Details (2)
- 1.1.9+ds1-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.1.9+ds1-1+deb13u1
  usn · opencc · debian · 13
- 1.1.9+ds1-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.1.9+ds1-1+deb13u1
  usn · opencc · debian · 13
[python3-opencc]Fixed
Source package: [opencc]
Details (2)
- 1.1.9+ds1-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.1.9+ds1-1+deb13u1
  usn · opencc · debian · 13
- 1.1.9+ds1-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.1.9+ds1-1+deb13u1
  usn · opencc · debian · 13

Observed: Oct 24, 2026, 2:01:05 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]