{"id":"CVE-2025-5222","details":"A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.","modified":"2026-04-10T05:32:06.118120Z","published":"2025-05-27T21:15:23.030Z","related":["ALSA-2025:11888","ALSA-2025:12083","MGASA-2025-0249","SUSE-SU-2025:02059-1","SUSE-SU-2025:02079-1","SUSE-SU-2025:02216-1","openSUSE-SU-2025:15230-1"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:12083"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:12331"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:12332"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:12333"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2025-5222"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:11888"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2368600"},{"type":"ARTICLE","url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00015.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/unicode-org/icu","events":[{"introduced":"0"},{"fixed":"457157a92aa053e632cc7fcfd0e12f8a943b2d11"}],"database_specific":{"versions":[{"introduced":"0"},{"fixed":"77.1"}]}}],"versions":["brs/2023-10-04","cldr-32-beta2","cldr/2020-09-22","cldr/2021-02-17","cldr/2021-03-09","cldr/2021-06-15","cldr/2021-08-11","cldr/2021-08-25","cldr/2021-09-15","cldr/2021-09-29","cldr/2022-02-08","cldr/2022-02-22","cldr/2022-02-23","cldr/2022-04-11","cldr/2022-05-28","cldr/2022-06-27","cldr/2022-08-01","cldr/2022-08-11","cldr/2022-08-17","cldr/2022-09-07","cldr/2022-09-12","cldr/2022-12-02","cldr/2022-12-04","cldr/2023-02-02","cldr/2023-02-21","cldr/2023-03-13","cldr/2023-03-15","cldr/2023-07-19","cldr/2023-07-20","cldr/2023-08-08","cldr/2023-08-22","cldr/2023-09-13","cldr/2023-09-25","cldr/2023-09-27","icu4x/2024-12-16/76.x","last-cvs-commit","last-svn-commit","milestone-59-0-1","milestone-60-0-1","release-59-rc","release-60-rc","release-61-rc","release-62-rc","release-63-rc","release-64-rc","release-65-rc","release-67-rc","release-68-alpha","release-68-rc","release-69-rc","release-70-rc","release-71-rc","release-72-rc","release-73-rc","release-74-rc","release-75-rc","release-76-rc","release-77-rc"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5222.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}