CVE-2025-15536: 
JavaScript vulnerability analysis and mitigation

CVE-2025-15536 is a heap-based buffer overflow (out-of-bounds read) vulnerability in BYVoid OpenCC, an open-source Chinese text conversion library. It affects the opencc::MaxMatchSegmentation::Segment function in src/MaxMatchSegmentation.cpp and all versions of OpenCC up to and including 1.1.9. The vulnerability was reported on December 23, 2025, published to NVD on January 18, 2026, and patched on January 13, 2026 via commit 345c9a50ab07018f1b4439776bad78a0d40778ec. It carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, and a CVSS v4.0 score of 1.9 (Low) per the CNA (GitHub Issue, GitHub Commit).

The root cause is improper bounds checking when processing malformed or truncated UTF-8 input sequences (CWE-122, CWE-787). In MaxMatchSegmentation.cpp, UTF8Util::NextCharLength() examines only the first byte of a UTF-8 sequence to determine the expected character length (1–6 bytes) without verifying that sufficient bytes remain in the buffer. The old code tracked remaining length via length -= matchedLength using a size_t counter; when matchedLength exceeded the actual remaining bytes, this caused integer underflow (wrapping to SIZE_MAX), leading to out-of-bounds reads in the subsequent MatchPrefix() call. A second related issue in Conversion.cpp allowed reads past the null terminator during dictionary matching, potentially leaking heap memory into conversion output. Exploitation requires providing a crafted string ending with an incomplete multi-byte UTF-8 sequence to any application using OpenCC's conversion API (GitHub Issue, GitHub PR #1005).

Successful exploitation can cause application crashes (denial of service) due to the heap out-of-bounds read, and may result in information disclosure by leaking heap memory contents into conversion output — particularly through the Conversion.cpp code path. Integrity impact is limited but possible if corrupted output is consumed downstream. The attack is restricted to local execution and requires low-privileged access, limiting the blast radius; however, applications that process untrusted user input through OpenCC (e.g., web services, text processing pipelines) may expose this vector to remote attackers indirectly (GitHub PR #1005, Feedly).

A public proof-of-concept reproducer file is available at https://github.com/oneafter/1222/blob/main/repro, and the issue was also submitted to VulDB. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.013% (0.000130), reflecting low probability of near-term exploitation. No threat actor attribution has been reported (GitHub PoC, VulDB, Feedly).

1. Identify target: Locate a system or application running BYVoid OpenCC version 1.1.9 or earlier that processes user-supplied text input (e.g., a text conversion tool or service using the OpenCC library).
2. Craft malicious input: Construct a string containing valid UTF-8 characters followed by a truncated multi-byte UTF-8 sequence — for example, a valid 3-byte character (e.g., 一, encoded as 0xE4 0xB8 0x80) followed by only the first two bytes of another 3-byte sequence (0xE4 0xB8), omitting the final byte.
3. Submit input: Pass the crafted string to the OpenCC conversion API (e.g., via SimpleConverter::Convert()) or pipe it to the opencc command-line tool: echo -ne '\xe4\xb8\x80\xe4\xb8' | opencc.
4. Trigger overflow: The MaxMatchSegmentation::Segment function calls NextCharLength(), which returns 3 for the incomplete sequence. The old length -= matchedLength operation underflows (2 - 3 = SIZE_MAX), causing the subsequent MatchPrefix() to read far beyond the allocated buffer.
5. Observe impact: The application crashes with a heap-buffer-overflow error (detectable via ASan), or in the Conversion.cpp path, heap memory contents may be included in the conversion output, constituting an information disclosure (GitHub Issue, GitHub PoC).

• Process: Unexpected crashes or aborts of applications using OpenCC (e.g., segmentation faults, SIGABRT), particularly when processing Chinese text input containing non-standard byte sequences.
• Logs: AddressSanitizer (ASan) reports referencing opencc::MaxMatchSegmentation::Segment in src/MaxMatchSegmentation.cpp:34 or Conversion::Convert in src/Conversion.cpp; error messages containing heap-buffer-overflow from OpenCC-linked processes.
• File System: Presence of crash dump files or core dumps from OpenCC-linked applications; unexpected binary input files (e.g., files containing truncated UTF-8 sequences like 0xE4 0xB8 without a terminating byte) submitted to conversion endpoints.
• Network: If OpenCC is used in a web service, HTTP requests containing malformed UTF-8 byte sequences in text conversion parameters (GitHub Issue).

Upgrade BYVoid OpenCC to a version newer than 1.1.9 that includes the fix from commit 345c9a50ab07018f1b4439776bad78a0d40778ec (merged January 13, 2026). OpenCC 1.2.0 packages are available for Debian, Ubuntu, and Fedora (42 and 43) through their respective package managers. As a workaround where upgrading is not immediately possible, restrict local system access to trusted users only and validate or sanitize UTF-8 input before passing it to OpenCC. Red Hat has tracked this issue in Bugzilla entry #2430670 (GitHub PR #1005, Red Hat Advisory).

Red Hat tracked the issue via Bugzilla and published a security advisory. The fix was reviewed and merged by the OpenCC project maintainer (BYVoid) on January 13, 2026, with Copilot AI also participating in code review. Linux distribution security teams for Ubuntu, Fedora, and SUSE issued advisories and updated their packages. Coverage was noted on security aggregation sites including LinuxSecurity.com and pro-linux.de, and the CVE was referenced in a Bluesky post by a CVE tracking account (Red Hat Advisory, GitHub PR #1005).