PT-2025-23037 · Debian+7 · Debian+7

Published 2024-11-14 · Updated 2026-03-01 · CVE-2025-5222

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions icu (affected versions not specified) Debian Linux (affected versions not specified)

Description A stack buffer overflow issue was discovered in the International Components for Unicode (ICU). The issue occurs when running the genrb binary, causing the 'subtag' struct to overflow at the SRBRoot::addTag function. This may result in memory corruption and potentially allow for local arbitrary code execution.

Recommendations For icu, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Debian Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

ALSA-2025:11888

ALSA-2025:12083

AZL-66147

AZL-66156

AZL-69692

AZL-69706

BDU:2025-10931

CVE-2025-5222

DLA-4217-1

DSA-5951-1

ECHO-DA2B-993E-93AC

INFSA-2025_12083

MGASA-2025-0249

OESA-2025-1982

OPENSUSE-SU-2025:15230-1

RHSA-2025:11888

RHSA-2025:12083

RHSA-2025:12331

RHSA-2025:12332

RHSA-2025:12333

RHSA-2025_12083

SUSE-SU-2025:02059-1

SUSE-SU-2025:02079-1

SUSE-SU-2025:02216-1

SUSE-SU-2025_02059-1

SUSE-SU-2025_02079-1

SUSE-SU-2025_02216-1

Affected Products

Almalinux

Astra Linux

Debian

Red Hat

Red Os

Rocky Linux

Suse

Icu

References · 74

• https://linux.oracle.com/errata/ELSA-2025-12083.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0249 · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2025-11888.html · Vendor Advisory
• https://osv.dev/vulnerability/AZL-69692 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2025-5222 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0126SE38 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1982 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-66147 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-5222 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4217-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:12332 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5951-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-5222 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:12083 · Vendor Advisory