Critical Stack Buffer Overflow in ICU Package: CVE-2025-5222
Summary
RLSA-2025:11888: Moderate: icu security update. Affects icu versions < 0:74.2-5.el10_0. Fixed in 0:74.2-5.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The International Components for Unicode (ICU) library is a widely used open-source library that provides robust and full-featured Unicode services for software applications. It supports various functionalities such as text processing, date and time formatting, and locale-sensitive operations. The ICU library is integral to many applications that require internationalization and localization support. However, a recently discovered vulnerability poses a significant risk to systems utilizing this library.
Vulnerability Detail
The vulnerability identified as CVE-2025-5222 is a stack buffer overflow in the SRBRoot::addTag function of the ICU library. This flaw can be exploited by an attacker to execute arbitrary code, potentially leading to unauthorized access, data corruption, or system crashes. The severity of this vulnerability is underscored by its CVSS score of 7.0, indicating a high level of risk. The issue arises from improper handling of input data, which allows for buffer overflow conditions.
How To Fix
Minimum fixed version
0:74.2-5.el10_0
This is the first release that contains the fix.
sudo dnf update icuTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the input data processed by the SRBRoot::addTag function to prevent exploitation. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
In summary, the CVE-2025-5222 vulnerability in the ICU library poses a significant risk due to a stack buffer overflow. It is crucial for users to update their ICU packages to the latest version to protect their systems from potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for icu →
FAQ
CVE-2025-5222 is a vulnerability in the ICU library that allows for a stack buffer overflow, potentially enabling attackers to execute arbitrary code.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access, data corruption, or system crashes, posing significant risks to affected systems.
Yes, a patch is available. Users should update the ICU package to version 0:74.2-5.el10_0 or later to mitigate the risk.
The CVSS score of CVE-2025-5222 is 7.0, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for icu.
