CVE-2011-4599: Icu-Project International Components For Unicode

High severity, CVSS 7.5. EPSS: 8% chance of exploitation in the next 30 days.

Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.

Affected products

• Icu-Project International Components For Unicode: before 49.1 (fixed in 49.1)

Published 2012-06-21. Last modified 2026-06-16.