CVE-2025-5222 Icu: stack buffer overflow in the srbroot::addtag function

High 7.0 Published 27 May 2025 Updated 21 Oct 2026

A stack buffer overflow in the ICU library's genrb binary allows local attackers to execute arbitrary code via memory corruption.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-5222?

CVE-2025-5222 is a high-severity memory corruption vulnerability in Red Hat Enterprise Linux 10, published on 27 May 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

Weakness: CWE-120

Which versions are affected by CVE-2025-5222?

It affects 1 product.

Linux distribution packages (40)

`icu` AlmaLinux:10	All versions	`74.2-5.el10_0`
`libicu` AlmaLinux:10	All versions	`74.2-5.el10_0`
`libicu-devel` AlmaLinux:10	All versions	`74.2-5.el10_0`
`icu` AlmaLinux:9	All versions	`67.1-10.el9_6`
`libicu` AlmaLinux:9	All versions	`67.1-10.el9_6`
`libicu-devel` AlmaLinux:9	All versions	`67.1-10.el9_6`
`icu` Red Hat:enterprise_linux:10.0	All versions	`0:74.2-5.el10_0`
`icu-debuginfo` Red Hat:enterprise_linux:10.0	All versions	`0:74.2-5.el10_0`
`icu-debugsource` Red Hat:enterprise_linux:10.0	All versions	`0:74.2-5.el10_0`
`libicu` Red Hat:enterprise_linux:10.0	All versions	`0:74.2-5.el10_0`
`libicu-debuginfo` Red Hat:enterprise_linux:10.0	All versions	`0:74.2-5.el10_0`
`libicu-devel` Red Hat:enterprise_linux:10.0	All versions	`0:74.2-5.el10_0`
`libicu-devel-debuginfo` Red Hat:enterprise_linux:10.0	All versions	`0:74.2-5.el10_0`
`icu` Red Hat:enterprise_linux:9::appstream	All versions	`0:67.1-10.el9_6`
`icu-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:67.1-10.el9_6`
`icu-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:67.1-10.el9_6`
`libicu-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:67.1-10.el9_6`
`libicu-devel` Red Hat:enterprise_linux:9::appstream	All versions	`0:67.1-10.el9_6`
`libicu-devel-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:67.1-10.el9_6`
`icu` Red Hat:enterprise_linux:9::baseos	All versions	`0:67.1-10.el9_6`
`icu-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:67.1-10.el9_6`
`icu-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:67.1-10.el9_6`
`libicu` Red Hat:enterprise_linux:9::baseos	All versions	`0:67.1-10.el9_6`
`libicu-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:67.1-10.el9_6`
`libicu-devel-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:67.1-10.el9_6`
`icu` Red Hat:rhel_e4s:9.0::appstream	All versions	`0:67.1-10.el9_0`
`icu-debuginfo` Red Hat:rhel_e4s:9.0::appstream	All versions	`0:67.1-10.el9_0`
`icu-debugsource` Red Hat:rhel_e4s:9.0::appstream	All versions	`0:67.1-10.el9_0`
`libicu-debuginfo` Red Hat:rhel_e4s:9.0::appstream	All versions	`0:67.1-10.el9_0`
`libicu-devel` Red Hat:rhel_e4s:9.0::appstream	All versions	`0:67.1-10.el9_0`
`libicu-devel-debuginfo` Red Hat:rhel_e4s:9.0::appstream	All versions	`0:67.1-10.el9_0`
`icu` Red Hat:rhel_e4s:9.0::baseos	All versions	`0:67.1-10.el9_0`
`icu-debuginfo` Red Hat:rhel_e4s:9.0::baseos	All versions	`0:67.1-10.el9_0`
`icu-debugsource` Red Hat:rhel_e4s:9.0::baseos	All versions	`0:67.1-10.el9_0`
`libicu` Red Hat:rhel_e4s:9.0::baseos	All versions	`0:67.1-10.el9_0`
`libicu-debuginfo` Red Hat:rhel_e4s:9.0::baseos	All versions	`0:67.1-10.el9_0`
`libicu-devel-debuginfo` Red Hat:rhel_e4s:9.0::baseos	All versions	`0:67.1-10.el9_0`
`icu` Red Hat:rhel_e4s:9.2::appstream	All versions	`0:67.1-10.el9_2`
`icu-debuginfo` Red Hat:rhel_e4s:9.2::appstream	All versions	`0:67.1-10.el9_2`
`icu-debugsource` Red Hat:rhel_e4s:9.2::appstream	All versions	`0:67.1-10.el9_2`

Products include Unicode International Components for Unicode.

How do I fix CVE-2025-5222?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-5222 being exploited?

There is no known exploitation of CVE-2025-5222 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as ALPINE-CVE-2025-5222, ALSA-2025:11888, ALSA-2025:12083, AZL-66147, AZL-66156, AZL-69692 and 25 more.