EPSS
Percentile
91.3%
icu4c is vulnerable to remote code execution (RCE) attacks. A malicious user can pass a string to the ucnv_UTF8FromUTF8 function in ucnv_u8.cpp to cause a buffer overflow that can crash the application or cause arbitrary code to be executed.
ucnv_UTF8FromUTF8
ucnv_u8.cpp
ssl.icu-project.org/trac/changeset/40714
ssl.icu-project.org/trac/changeset/40715
ssl.icu-project.org/trac/ticket/13490
ssl.icu-project.org/trac/ticket/13510