CVE-2025-5222
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A stack buffer overflow was found in the International Components for Unicode (ICU) library when running the genrb binary. The vulnerability occurs in the SRBRoot::addTag function, where the 'subtag' struct overflows, potentially leading to memory corruption and local arbitrary code execution.
Risk Assessment
An attacker with local access could exploit this vulnerability to execute arbitrary code, potentially compromising the application or system.
Recommendation
It is recommended to immediately update the ICU library to the latest patched version and avoid running the genrb tool on untrusted input.
Other vulnerabilities in ICU
See all- CVE-2016-7594High
An issue was discovered in certain Apple products, including iOS before 10.2, macOS before 10.12.2, and watchOS before 3.1.3, related to the 'ICU' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
- CVE-2020-21913Medium
International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp.
- CVE-2020-10531High
An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.
- CVE-2017-15422Medium
Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Original NVD description (English source)
A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS