CVE-2020-21913
MediumCVSS 5.5Exploitation Probability (EPSS)
Elevated risk68th percentile - higher than 68% of all known CVEs
Summary
International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp.
Risk Assessment
May lead to application crash or potential arbitrary code execution. Risk affects tools using ICU for data processing.
Recommendation
Update ICU to a version newer than 66.1. Avoid using vulnerable tools to process untrusted data.
Other vulnerabilities in ICU
See all- CVE-2016-7594High
An issue was discovered in certain Apple products, including iOS before 10.2, macOS before 10.12.2, and watchOS before 3.1.3, related to the 'ICU' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
- CVE-2025-5222High
A stack buffer overflow was found in the International Components for Unicode (ICU) library when running the genrb binary. The vulnerability occurs in the SRBRoot::addTag function, where the 'subtag' struct overflows, potentially leading to memory corruption and local arbitrary code execution.
- CVE-2020-10531High
An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.
- CVE-2017-15422Medium
Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Original NVD description (English source)
International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS