CVE-2025-5222

HighCVSS 7.0

Published: 27/05/2025(UTC)Updated: 17/09/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

36th percentile - higher than 36% of all known CVEs

Summary

A stack buffer overflow was found in the International Components for Unicode (ICU) library when running the genrb binary. The vulnerability occurs in the SRBRoot::addTag function, where the 'subtag' struct overflows, potentially leading to memory corruption and local arbitrary code execution.

Risk Assessment

An attacker with local access could exploit this vulnerability to execute arbitrary code, potentially compromising the application or system.

Recommendation

It is recommended to immediately update the ICU library to the latest patched version and avoid running the genrb tool on untrusted input.

Other vulnerabilities in ICU

CVE-2016-7594High
An issue was discovered in certain Apple products, including iOS before 10.2, macOS before 10.12.2, and watchOS before 3.1.3, related to the 'ICU' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.

Original NVD description (English source)

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.