CVE-2018-18928: Icu-Project International Components For Unicode

Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days.

International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.

Affected products

• Icu-Project International Components For Unicode: version 63.1 only

Published 2018-11-04. Last modified 2026-06-17.