International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/unicode-org/icu/commit/53d8c8f3d181d87a6aa925b449b51c4a2c922a51 Patch, Vendor Advisory
- https://unicode-org.atlassian.net/browse/ICU-20246 Vendor Advisory
- https://github.com/unicode-org/icu/commit/53d8c8f3d181d87a6aa925b449b51c4a2c922a51 Patch, Vendor Advisory
- https://unicode-org.atlassian.net/browse/ICU-20246 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · icu-projectNVD modified 2026-10-14 07:16
Affected (CPE criteria) 1
cpe:2.3:a:icu-project:international_components_for_unicode:63.1:*:*:*:*:c\/c\+\+:*:*
References 7
- https://bugs.chromium.org/p/chromium/issues/detail?id=900059 Third Party Advisory
- https://github.com/unicode-org/icu/commit/53d8c8f3d181d87a6aa925b449b51c4a2c922a51 Patch, Vendor Advisory
- https://unicode-org.atlassian.net/browse/ICU-20246 Vendor Advisory
- https://bugs.chromium.org/p/chromium/issues/detail?id=900059 Third Party Advisory
- https://github.com/unicode-org/icu/commit/53d8c8f3d181d87a6aa925b449b51c4a2c922a51 Patch, Vendor Advisory
- https://unicode-org.atlassian.net/browse/ICU-20246 Vendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html