CVE-2025-5222

Publication date 27 May 2025

Last updated 11 July 2025


Ubuntu priority

Cvss 3 Severity Score

7.0 · High

Score breakdown

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the ‘subtag’ struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

Read the notes from the security team

Why is this CVE low priority?

DoS in a command line tool only

Learn more about Ubuntu priority

Status

Package Ubuntu Release Status
icu 25.04 plucky
Vulnerable, fix deferred
24.10 oracular Ignored end of life, was deferred [2025-05-28]
24.04 LTS noble
Vulnerable, fix deferred
22.04 LTS jammy
Vulnerable, fix deferred
20.04 LTS focal
Vulnerable, fix deferred
18.04 LTS bionic
Vulnerable, fix deferred
16.04 LTS xenial
Vulnerable, fix deferred
14.04 LTS trusty
Vulnerable, fix deferred

Notes


mdeslaur

as of 2025-05-28, there is no fix available from ICU developers This is only a stack overflow issue in a command-line tool. Because of compiler hardening, this is likely a DoS only.

Severity score breakdown

Parameter Value
Base score 7.0 · High
Attack vector Local
Attack complexity High
Privileges required None
User interaction Required
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H