CVE-2025-5222

Name	CVE-2025-5222
Description	A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1106684

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
icu (PTS)	bullseye	67.1-7	vulnerable
	bookworm	72.1-3	vulnerable
	trixie	76.1-3	vulnerable
	sid	76.1-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
icu	source	(unstable)	76.1-4			1106684

Notes

https://unicode-org.atlassian.net/browse/ICU-22957
Fixed by: https://github.com/unicode-org/icu/commit/2c667e31cfd0b6bb1923627a932fd3453a5bac77 (release-77-rc)