CVE-2025-5222: Icu: stack buffer overflow in the srbroot::addtag function
A stack buffer overflow was found in ICU version 76.0.1. While running the genrb binary the 'subtag' struct is overflowed in SRBRoot::addTag function. This may lead to memory corruption and arbitrary code execution.
Other sources
A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.
— MITRE
Icu: stack buffer overflow in the srbroot::addtag function
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5222?
CVE-2025-5222 is considered a critical vulnerability due to its potential for memory corruption and arbitrary code execution.
How do I fix CVE-2025-5222?
To mitigate CVE-2025-5222, update the ICU library to the latest version that addresses this vulnerability.
What are the potential impacts of CVE-2025-5222?
CVE-2025-5222 can lead to memory corruption which may allow an attacker to execute arbitrary code on the affected system.
Which software is affected by CVE-2025-5222?
CVE-2025-5222 affects ICU version 76.0.1, particularly when using the genrb binary.
Is CVE-2025-5222 exploitable remotely?
Yes, CVE-2025-5222 can be exploited remotely if the vulnerable software is exposed in an environment that allows for the execution of crafted input.