PatchTheCVE: icu-projecthttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1https://patchthecve.com/cve/CVE-2020-10531.htmlhttps://patchthecve.com/cve/CVE-2020-10531.htmlWed, 14 Oct 2026 09:17:16 +0000HIGH 8.8: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.CVE-2018-18928: International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuanhttps://patchthecve.com/cve/CVE-2018-18928.htmlhttps://patchthecve.com/cve/CVE-2018-18928.htmlWed, 14 Oct 2026 07:16:43 +0000CRITICAL 9.8: International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.CVE-2017-15396: A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2https://patchthecve.com/cve/CVE-2017-15396.htmlhttps://patchthecve.com/cve/CVE-2017-15396.htmlWed, 17 Jun 2026 01:07:45 +0000MEDIUM 6.5: A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2017-15422: Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ beforehttps://patchthecve.com/cve/CVE-2017-15422.htmlhttps://patchthecve.com/cve/CVE-2017-15422.htmlWed, 14 Oct 2026 07:16:39 +0000MEDIUM 6.5: Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.CVE-2017-17484: The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through https://patchthecve.com/cve/CVE-2017-17484.htmlhttps://patchthecve.com/cve/CVE-2017-17484.htmlWed, 17 Jun 2026 01:10:51 +0000CRITICAL 9.8: The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possiblyCVE-2017-14952: Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows rhttps://patchthecve.com/cve/CVE-2017-14952.htmlhttps://patchthecve.com/cve/CVE-2017-14952.htmlWed, 17 Jun 2026 01:07:02 +0000CRITICAL 9.8: Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows remote attackers to execute arbitrary code via a crafted string, aka a "redundant UVector entry clean up function call" issue.CVE-2014-9654: The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as https://patchthecve.com/cve/CVE-2014-9654.htmlhttps://patchthecve.com/cve/CVE-2014-9654.htmlWed, 17 Jun 2026 00:18:43 +0000CRITICAL 9.8: The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of serviCVE-2017-7868: International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a https://patchthecve.com/cve/CVE-2017-7868.htmlhttps://patchthecve.com/cve/CVE-2017-7868.htmlWed, 17 Jun 2026 01:25:22 +0000HIGH 7.5: International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function.CVE-2017-7867: International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a https://patchthecve.com/cve/CVE-2017-7867.htmlhttps://patchthecve.com/cve/CVE-2017-7867.htmlWed, 17 Jun 2026 01:25:22 +0000HIGH 7.5: International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.CVE-2014-9911: Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International https://patchthecve.com/cve/CVE-2014-9911.htmlhttps://patchthecve.com/cve/CVE-2014-9911.htmlWed, 17 Jun 2026 00:19:12 +0000CRITICAL 9.8: Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.CVE-2016-7415: Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (Ihttps://patchthecve.com/cve/CVE-2016-7415.htmlhttps://patchthecve.com/cve/CVE-2016-7415.htmlWed, 17 Jun 2026 00:53:01 +0000CRITICAL 9.8: Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.