CVE-2025-5222
CVE-2025-5222 · Icu: stack buffer overflow in the srbroot::addtag function
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.
CVSS 7.0 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
red hat enterprise linux 10
- Versions
- ≥ 0:74.2-5.el10_0: Not affected (rpm)
No fix published
red hat enterprise linux 9
- Versions
- ≥ 0:67.1-10.el9_6: Not affected (rpm)
No fix published
red hat enterprise linux 9.0 update services for sap solutions
- Versions
- ≥ 0:67.1-10.el9_0: Not affected (rpm)
No fix published
red hat enterprise linux 9.2 update services for sap solutions
- Versions
- ≥ 0:67.1-10.el9_2: Not affected (rpm)
No fix published
red hat enterprise linux 9.4 extended update support
- Versions
- ≥ 0:67.1-10.el9_4: Not affected (rpm)
No fix published
red hat openshift container platform 4.13
- Versions
- ≥ 413.92.202609080414-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.14
- Versions
- ≥ 414.92.202608172040-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.15
- Versions
- ≥ 415.92.202608180329-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.16
- Versions
- ≥ 416.94.202608150307-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.17
- Versions
- ≥ 417.94.202608250221-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.18
- Versions
- ≥ 418.94.202608111829-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.19
- Versions
- ≥ 4.19.9.6.202608120446-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.20
- Versions
- ≥ 4.20.9.6.202608121719-0: Not affected (rpm)
No fix published
red hat enterprise linux 6
No fix published
red hat enterprise linux 7
No fix published
red hat enterprise linux 8
No fix published
red hat openshift container platform 4
No fix published
icu Debian:12
- Versions
- 72.1-3
- Affected ranges
- ECOSYSTEM: < 72.1-3+deb12u1
Update to 72.1-3+deb12u1
icu Debian:13
- Affected ranges
- ECOSYSTEM: < 76.1-4
Update to 76.1-4
icu Debian:14
- Affected ranges
- ECOSYSTEM: < 76.1-4
Update to 76.1-4
icu Ubuntu:Pro:14.04:LTS
- Versions
- 4.8.1.1-12ubuntu2
- 4.8.1.1-13+nmu1
- 4.8.1.1-13+nmu1ubuntu1
- 52.1-3
- 52.1-3ubuntu0.2
- 52.1-3ubuntu0.3
- 52.1-3ubuntu0.4
- 52.1-3ubuntu0.5
- 52.1-3ubuntu0.6
- 52.1-3ubuntu0.7
- 52.1-3ubuntu0.8
- 52.1-3ubuntu0.8+esm1
- 52.1-3ubuntu0.8+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
icu Ubuntu:Pro:16.04:LTS
- Versions
- 55.1-4ubuntu1
- 55.1-6ubuntu1
- 55.1-7
- 55.1-7ubuntu0.1
- 55.1-7ubuntu0.2
- 55.1-7ubuntu0.3
- 55.1-7ubuntu0.4
- 55.1-7ubuntu0.5
- 55.1-7ubuntu0.5+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
icu Ubuntu:18.04:LTS
- Versions
- 57.1-6
- 59.1-3ubuntu1
- 60.1-1ubuntu2
- 60.2-1ubuntu1
- 60.2-3ubuntu1
- 60.2-3ubuntu3
- 60.2-3ubuntu3.1
- 60.2-3ubuntu3.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
icu Ubuntu:20.04:LTS
- Versions
- 63.2-2
- 65.1-1ubuntu2
- 66.1-2ubuntu2
- 66.1-2ubuntu2.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://access.redhat.com/errata/RHSA-2025:11888
- https://access.redhat.com/errata/RHSA-2025:12083
- https://access.redhat.com/errata/RHSA-2025:12331
- https://access.redhat.com/errata/RHSA-2025:12332
- https://access.redhat.com/errata/RHSA-2025:12333
- https://access.redhat.com/errata/RHSA-2026:54544
- https://access.redhat.com/errata/RHSA-2026:54553
- https://access.redhat.com/errata/RHSA-2026:54581
- https://access.redhat.com/errata/RHSA-2026:56786
- https://access.redhat.com/errata/RHSA-2026:56853
- https://access.redhat.com/errata/RHSA-2026:56911
- https://access.redhat.com/errata/RHSA-2026:60019
- https://access.redhat.com/errata/RHSA-2026:65839
- https://access.redhat.com/security/cve/CVE-2025-5222
- https://bugzilla.redhat.com/show_bug.cgi?id=2368600
- https://unicode-org.atlassian.net/jira/software/c/projects/ICU/issues/ICU-22957
- https://lists.debian.org/debian-lts-announce/2025/06/msg00015.html
- https://cert-portal.siemens.com/productcert/html/ssa-585531.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-5222