CVE-2007-4770: libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which…

PriorityP427medium6.8CVSS 2.0

AVNACMAuNCPIPAP

EPSS

2.82%

84.8th percentile

libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory locations, related to corruption of REStackFrames.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
debian	icu	< icu 3.8-6 (bookworm)	icu 3.8-6 (bookworm)
icu-project	international_components_for_unicode	<= 3.8.1	—

CVSS provenance

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

osv6.8MEDIUM

vendor_debian6.8MEDIUM

vendor_redhat6.8MEDIUM

vendor_ubuntu6.8MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.