Stack Buffer Overflow in ICU Package: CVE-2025-5222
Summary
CVE-2025-5222: A stack buffer overflow was found in Internationl components for unicode (ICU ). Affects icu versions < 74.1-r1. Fixed in 74.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The International Components for Unicode (ICU) is a widely-used library that provides robust and full-featured Unicode and Globalization support for software applications. It is essential for handling text in various languages and formats, ensuring that applications can process and display internationalized content correctly. However, the ICU package has been found to have a critical vulnerability that could lead to severe security risks.
Vulnerability Detail
A stack buffer overflow was identified in the ICU library, specifically within the 'genrb' binary. The vulnerability arises in the SRBRoot::addTag function, where the 'subtag' struct can overflow. This overflow can lead to memory corruption, potentially allowing local arbitrary code execution. Attackers exploiting this vulnerability could manipulate the program's execution flow, leading to unauthorized actions or data breaches.
How To Fix
Minimum fixed version
74.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade icuTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the execution of the 'genrb' binary or avoid using it until a patch is applied. Additionally, running the application in a controlled environment with restricted permissions may help mitigate the risk of exploitation.
Conclusion
The CVE-2025-5222 vulnerability in the ICU package poses significant risks due to its potential for memory corruption and arbitrary code execution. Users are strongly advised to update their ICU installations to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for icu →
FAQ
CVE-2025-5222 is a vulnerability in the ICU package that allows for a stack buffer overflow, potentially leading to memory corruption and arbitrary code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and potential control over the affected system.
Yes, users should update to the latest version of the ICU package to ensure they are protected against CVE-2025-5222.
The CVSS score for CVE-2025-5222 is 7.0, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for icu.
