Description
A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | icu | < 78.1 | 78.1 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | icu | 76.1-4 | — |
| Debian 13 | icu | 76.1-4 | — |
| Debian 12 | icu | 72.1-3+deb12u1 | DSA-5951-1 |
| Debian 11 | icu | 67.1-7+deb11u1 | DLA-4217-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | icu | No fix yet | — |
| Ubuntu 24.04 LTS | icu | No fix yet | — |
| Ubuntu 22.04 LTS | icu | No fix yet | — |
| Ubuntu 20.04 LTS | icu | No fix yet | — |
| Ubuntu 18.04 LTS | icu | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | icu | No fix yet | — |
| Ubuntu Pro 14.04 LTS | icu | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | icu +2 | 74.2-5.el10_0 | RHSA-2025:11888 |
| RHEL 9 | icu +2 | 67.1-10.el9_6 | RHSA-2025:12083 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | icu +2 | 67.1-10.el9_4 | RHSA-2025:12332 |
| RHEL 9.2 E4S | icu +2 | 67.1-10.el9_2 | RHSA-2025:12331 |
| RHEL 9.0 E4S | icu +2 | 67.1-10.el9_0 | RHSA-2025:12333 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | icu +2 | 74.2-5.el10_0 | ALSA-2025:11888 |
| AlmaLinux 9 | icu +2 | 67.1-10.el9_6 | ALSA-2025:12083 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | icu | 74.2-5.el10_0 | RLSA-2025:11888 |
| Rocky Linux 9 | icu | 67.1-10.el9_6 | RLSA-2025:12083 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | icu | 60.2-150000.3.18.1 | SUSE-SU-2025:02079-1, SUSE-SU-2025:02059-1 |
| SLES 15 SP6 | icu | 60.2-150000.3.18.1 | SUSE-SU-2025:02079-1, SUSE-SU-2025:02059-1 |
| SLES 15 SP5 | icu | 60.2-150000.3.18.1 | SUSE-SU-2025:02079-1, SUSE-SU-2025:02059-1 |
| SLES 15 SP4 | icu | 60.2-150000.3.18.1 | SUSE-SU-2025:02079-1, SUSE-SU-2025:02059-1 |
| SLES 15 SP3 | icu | 60.2-150000.3.18.1 | SUSE-SU-2025:02079-1, SUSE-SU-2025:02059-1 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | icu | 52.1-8.16.1 | SUSE-SU-2025:02216-1 |
| SLES for SAP 15 SP5 | icu | 60.2-150000.3.18.1 | SUSE-SU-2025:02079-1, SUSE-SU-2025:02059-1 |
| SLES for SAP 15 SP4 | icu | 60.2-150000.3.18.1 | SUSE-SU-2025:02079-1, SUSE-SU-2025:02059-1 |
| SLES for SAP 15 SP3 | icu | 60.2-150000.3.18.1 | SUSE-SU-2025:02079-1, SUSE-SU-2025:02059-1 |
| SLE Micro 5.4 | icu | 65.1-150200.4.15.1 | SUSE-SU-2025:02079-1 |
| SLE Micro 5.3 | icu | 65.1-150200.4.15.1 | SUSE-SU-2025:02079-1 |
| SLE Micro 5.2 | icu | 65.1-150200.4.15.1 | SUSE-SU-2025:02079-1 |
| SLE Micro 5.1 | icu | 65.1-150200.4.15.1 | SUSE-SU-2025:02079-1 |
| SLE HPC 15 SP5 | icu | 65.1-150200.4.15.1 | SUSE-SU-2025:02079-1 |
| SLE HPC 15 SP4 | icu | 60.2-150000.3.18.1 | SUSE-SU-2025:02079-1, SUSE-SU-2025:02059-1 |
| SLE HPC 15 SP3 | icu | 60.2-150000.3.18.1 | SUSE-SU-2025:02079-1, SUSE-SU-2025:02059-1 |
| SUSE Manager Server 4.3 | icu | 65.1-150200.4.15.1 | SUSE-SU-2025:02079-1 |
| SUSE Manager Proxy 4.3 | icu | 65.1-150200.4.15.1 | SUSE-SU-2025:02079-1 |
| SUSE Enterprise Storage 7.1 | icu | 60.2-150000.3.18.1 | SUSE-SU-2025:02079-1, SUSE-SU-2025:02059-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | icu | 77.1-3.1 | openSUSE-SU-2025:15230-1 |
| openSUSE Leap 15.6 | icu | 65.1-150200.4.15.1 | SUSE-SU-2025:02079-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | icu | 76.1-r1 | — |
| Alpine v3.23 | icu | 76.1-r1 | — |
| Alpine v3.22 | icu | 76.1-r1 | — |
| Alpine v3.21 | icu | 74.2-r1 | — |
| Alpine v3.20 | icu | 74.2-r1 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | icu | 74.1-r1 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | icu +3 | 67.1-7.amzn2023.0.4 | ALAS2023-2025-1057 |
| Amazon Linux 2 | icu +3 | 50.2-4.amzn2.0.2 | ALAS2-2025-2914 |
| Amazon Linux 2 | libicu60 +2 | 60.3-2.amzn2.0.6 | ALAS2-2025-2913 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | icu | 72.1.0.3-2 | — |
| Azure Linux 3 | nodejs | 20.14.0-10 | — |
| Azure Linux 2 (CBL-Mariner) | icu | 68.2.0.9-2 | — |
| Azure Linux 2 (CBL-Mariner) | nodejs18 | 18.20.3-10 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | icu +2 | 74.2-5.el10_0 | ELSA-2025-11888 |
| Oracle Linux 9 | icu +2 | 67.1-10.el9_6 | ELSA-2025-12083 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
berkley4/icu-74-debian ★ 1 · Jun 25, 2025
Debian build files for icu 74.2 with a patch to fix CVE-2025-5222
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 26
- ALSA-2025:11888 Moderate: icu security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:12083 Moderate: icu security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:12333 Red Hat Security Advisory: icu security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:12331 Red Hat Security Advisory: icu security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:12332 Red Hat Security Advisory: icu security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:12083 Red Hat Security Advisory: icu security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:11888 Red Hat Security Advisory: icu security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2025-1406 International Components for Unicode (icu): Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Sep 17, 2026
- VDE-2026-088 METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4 CERT@VDE · Sep 10, 2026
- WID-SEC-2026-2451 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 2, 2026
- ICSA-26-202-04 Siemens SIDIS Secured SmartPlug CISA ICS & IT advisories · Jul 21, 2026
- NCSC-2026-0229 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jul 14, 2026
- SSA-585531 SSA-585531: Multiple Vulnerabilities in SIDIS Secured SmartPlug before V7.26.0310 Siemens ProductCERT · Jul 14, 2026
- openSUSE-SU-2025:15230-1 icu-77.1-3.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02079-1 Security update for icu SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-4217-1 icu - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-5951-1 icu - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:02059-1 Security update for icu SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2025:11888 Moderate: icu security update Rocky Linux Security Advisories · Oct 8, 2025
- RLSA-2025:12083 Moderate: icu security update Rocky Linux Security Advisories · Oct 7, 2025
- ELSA-2025-12083 Moderate: icu security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 29, 2025
- ELSA-2025-11888 Moderate: icu security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 28, 2025
- ALAS2-2025-2914 Important: icu security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 10, 2025
- ALAS2-2025-2913 Important: libicu60 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 10, 2025
- ALAS2023-2025-1057 Important: icu security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 10, 2025
- SUSE-SU-2025:02216-1 Security update for icu SUSE / openSUSE Security Updates · Jul 3, 2025
References
- RHSA-2025:11888 vendor-advisory
- RHSA-2025:12083 vendor-advisory
- RHSA-2025:12331 vendor-advisory
- RHSA-2025:12332 vendor-advisory
- RHSA-2025:12333 vendor-advisory
- RHSA-2026:54544 vendor-advisory
- RHSA-2026:54553 vendor-advisory
- RHSA-2026:54581 vendor-advisory
- RHSA-2026:56786 vendor-advisory
- RHSA-2026:56853 vendor-advisory
- RHSA-2026:56911 vendor-advisory
- RHSA-2026:60019 vendor-advisory
- RHSA-2026:65839 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-5222 vdb-entry
- RHBZ#2368600 issue-tracking
- https://unicode-org.atlassian.net/jira/software/c/projects/ICU/issues/ICU-22957