Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 29 March 2026.

Which products and versions are affected?

opencc (npm) SEMVER:introduced=0,fixed=1.2.0.

Is there a fix for This vulnerability?

Yes. opencc (npm): upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run opencc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

OpenCC out-of-bounds read in UTF-8 processing

Severity: low · CVSS 3.1 · Published 2026-03-29

OpenCC is a library used to convert between different forms of Chinese characters. When processing malformed or truncated UTF-8 text, the library fails to validate input boundaries and reads past the end of the buffer, potentially exposing data in memory or causing the application to crash. This affects any application using OpenCC to handle user-supplied text.

Technologies: opencc (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 29 March 2026.
Which products and versions are affected?: opencc (npm) SEMVER:introduced=0,fixed=1.2.0.
Is there a fix for This vulnerability?: Yes. opencc (npm): upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run opencc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

opencc (npm): upgrade to 1.2.0 or later
```
npm install opencc@1.2.0
```

Technical details

OpenCC versions before 1.2.0 contain out-of-bounds read vulnerabilities (CWE-125) in UTF-8 text processing. The root cause is a length validation failure: two code paths in MaxMatchSegmentation::Segment and Conversion::Convert fail to enforce the invariant that matchedLength ≤ remainingLength when handling malformed UTF-8 sequences. When processing truncated UTF-8 input (e.g., a 3-byte character missing its final byte), the library derives an incorrect length value, advances the input pointer beyond buffer bounds, and reads into adjacent memory—potentially beyond the null terminator. The attack vector is network-accessible if OpenCC processes untrusted UTF-8 input. No authentication or user interaction is required. Patch 1.2.0 fixes both issues by explicitly tracking input boundaries and clamping processed lengths to enforce the buffer invariant.

Affected products

BYVoid OpenCC < 1.2.0

Timeline

2026-03-29: disclosed
2026-03-27: patched: Version 1.2.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.