CVE-2017-14952: Icu-Project International Components For Unicode

Critical severity, CVSS 9.8. EPSS: 5.1% chance of exploitation in the next 30 days.

Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows remote attackers to execute arbitrary code via a crafted string, aka a "redundant UVector entry clean up function call" issue.

Affected products

• Icu-Project International Components For Unicode: up to and including 59.1

Published 2017-10-16. Last modified 2026-06-17.