CVE-2025-5222

What it actually does

Stack buffer overflow in SRBRoot::addTag during genrb execution allows memory corruption and potential local arbitrary code execution.

Why it matters to the business

Attackers with local access can achieve code execution on systems processing ICU data files, risking compromise of development or build environments; low exploit likelihood but affects widely used Unicode components and downstream applications like Thunderbird.

How an attack unfolds

An attacker crafts a malicious subtag input that overflows the struct when genrb is invoked locally; the overflow corrupts memory and can be leveraged for code execution under high complexity conditions requiring user interaction.

How to fix it

Upgrade unicode-org/icu to commit 457157a92aa053e632cc7fcfd0e12f8a943b2d11 or later; for Ubuntu 18.04 LTS Thunderbird, upgrade to 1:102.4.2+build2-0ubuntu0.18.04.1 or newer.

How to confirm the fix worked

Verify installed ICU or Thunderbird versions against the listed fixed commits/packages; test genrb with known-good inputs and confirm absence of crashes on boundary cases.

Typical attack path

1. Obtain or create a malicious resource bundle input file triggering subtag overflow
2. Invoke the genrb binary locally with the crafted file
3. Trigger the overflow in SRBRoot::addTag to corrupt stack memory
4. Achieve arbitrary code execution within the process context

How to detect it

Review process execution logs for genrb invocations with unusual inputs; inspect crash reports or memory dumps for signs of stack corruption around addTag calls.

What your security team should do

• Prioritize patching ICU in build pipelines and Thunderbird installations
• Restrict local execution of genrb to trusted users and inputs
• Monitor EPSS trend and re-evaluate if exploit maturity increases