CVE-2025-5222

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

References

Affected packages

Git / github.com/unicode-org/icu

Affected ranges

Type

GIT

Repo

https://github.com/unicode-org/icu

Events

Introduced

Fixed

457157a92aa053e632cc7fcfd0e12f8a943b2d11

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "77.1"
        }
    ]
}

Affected versions

Other

brs/2023-10-04

cldr-32-beta2

cldr/2020-09-22

cldr/2020-10-21

cldr/2021-02-17

cldr/2021-03-09

cldr/2021-06-15

cldr/2021-08-11

cldr/2021-08-25

cldr/2021-09-15

cldr/2021-09-29

cldr/2021-10-19

cldr/2021-10-25

cldr/2022-02-08

cldr/2022-02-22

cldr/2022-02-23

cldr/2022-03-30

cldr/2022-03-31

cldr/2022-04-11

cldr/2022-05-28

cldr/2022-06-27

cldr/2022-08-01

cldr/2022-08-11

cldr/2022-08-17

cldr/2022-09-07

cldr/2022-09-12

cldr/2022-10-11

cldr/2022-12-02

cldr/2022-12-04

cldr/2023-02-02

cldr/2023-02-21

cldr/2023-03-13

cldr/2023-03-15

cldr/2023-04-06

cldr/2023-04-10

cldr/2023-07-19

cldr/2023-07-20

cldr/2023-08-08

cldr/2023-08-22

cldr/2023-09-13

cldr/2023-09-25

cldr/2023-09-27

last-cvs-commit

last-svn-commit

milestone-59-0-1

milestone-60-0-1

release-59-rc

release-60-rc

release-61-rc

release-62-rc

release-63-rc

release-64-1

release-64-2

release-64-2-rc

release-64-rc

release-64-rc2

release-65-1

release-65-rc

release-66-1

release-66-preview

release-66-rc

release-67-1

release-67-rc

release-68-1

release-68-alpha

release-68-rc

release-69-1

release-69-rc

release-70-1

release-70-rc

release-71-1

release-71-rc

release-72-1

release-72-rc

release-72-rc-cldr-beta3

release-73-1

release-73-rc

release-74-1

release-74-rc

release-75-1

release-75-rc

release-76-1

release-76-rc

release-77-rc

icu4x/2024-12-16/76.*

icu4x/2024-12-16/76.x

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-5222.json"

vanir_signatures

[
    {
        "digest": {
            "line_hashes": [
                "295309340300957685074609112300146940891",
                "269428952573887231121339385406655395190",
                "190437084686170097544538184536125984890",
                "132830090117250644852007522560018821043",
                "112107708379846581411362349218816624036",
                "260794071025088050772994361148691988165",
                "160056934528296243121673659860885287692",
                "199959194778351910290111171664332697668",
                "21353937669025376178533552682433403790",
                "167070727992870648319088480499172857939"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "icu4j/main/common_tests/src/test/java/com/ibm/icu/dev/test/util/ULocaleTest.java"
        },
        "id": "CVE-2025-5222-766869b3",
        "deprecated": false,
        "source": "https://github.com/unicode-org/icu/commit/457157a92aa053e632cc7fcfd0e12f8a943b2d11",
        "signature_version": "v1",
        "signature_type": "Line"
    },
    {
        "digest": {
            "function_hash": "148691341547682037182391118470639084436",
            "length": 1432.0
        },
        "target": {
            "file": "tools/cldr/cldr-to-icu/src/main/java/org/unicode/icu/tool/cldrtoicu/localedistance/LikelySubtagsBuilder.java",
            "function": "makeTable"
        },
        "id": "CVE-2025-5222-9e6bb5ba",
        "deprecated": false,
        "source": "https://github.com/unicode-org/icu/commit/457157a92aa053e632cc7fcfd0e12f8a943b2d11",
        "signature_version": "v1",
        "signature_type": "Function"
    },
    {
        "digest": {
            "function_hash": "271089080750162150157587461146173822207",
            "length": 1213.0
        },
        "target": {
            "file": "icu4j/main/common_tests/src/test/java/com/ibm/icu/dev/test/util/ULocaleTest.java",
            "function": "likelySubtagsDataDriven"
        },
        "id": "CVE-2025-5222-b2a66e6c",
        "deprecated": false,
        "source": "https://github.com/unicode-org/icu/commit/457157a92aa053e632cc7fcfd0e12f8a943b2d11",
        "signature_version": "v1",
        "signature_type": "Function"
    },
    {
        "digest": {
            "line_hashes": [
                "145407242532596960075001884462414527957",
                "6534213920094264024438550808963261444",
                "162621325529188262072181660939151906139",
                "45440760445035304046139458375865290848",
                "244328417444030477861086662771865464854",
                "122656055037654942970210796009288544218",
                "250990121404058258699060639881303912114"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "icu4c/source/test/intltest/loctest.cpp"
        },
        "id": "CVE-2025-5222-b413e474",
        "deprecated": false,
        "source": "https://github.com/unicode-org/icu/commit/457157a92aa053e632cc7fcfd0e12f8a943b2d11",
        "signature_version": "v1",
        "signature_type": "Line"
    },
    {
        "digest": {
            "line_hashes": [
                "231557820963995623085211029920202569377",
                "150755075343856115356668913111124766129",
                "330690527451913616862358615079352288882",
                "116663865726823617015987705167129230456"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "tools/cldr/cldr-to-icu/src/main/java/org/unicode/icu/tool/cldrtoicu/localedistance/LikelySubtagsBuilder.java"
        },
        "id": "CVE-2025-5222-c7b08b4c",
        "deprecated": false,
        "source": "https://github.com/unicode-org/icu/commit/457157a92aa053e632cc7fcfd0e12f8a943b2d11",
        "signature_version": "v1",
        "signature_type": "Line"
    }
]