CVE-2025-5222: Unicode International Components For Unicode

High severity, CVSS 7.0. EPSS: 0.4% chance of exploitation in the next 30 days.

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

Affected products

• Unicode International Components For Unicode: before 77.1 (fixed in 77.1)

Published 2025-05-27. Last modified 2026-10-09.