A stack buffer overflow was discovered in the Internationl components for unicode (ICU) library, specifically within the SRBRoot::addTag function when processing the genrb binary. The overflow corrupts the stack, enabling a local attacker who can run or influence the genrb program to overwrite adjacent memory and trigger arbitrary code execution. The vulnerability falls under CWE‑120, a classic buffer overflow that compromises memory integrity and potentially the entire process. The impact is local arbitrary code execution, which could be used to elevate privileges or sabotage applications that rely on ICU for string processing.

Red Hat systems are affected, including Red Hat Enterprise Linux releases 6, 7, 8, 9, and 10 and their associated extended support streams (9.0, 9.2, 9.4). The OpenShift Container Platform 4 is also impacted because it embeds the ICU library. All affected systems run various packages identified by the following CPEs: redhat:enterprise_linux:6, redhat:enterprise_linux:7, redhat:enterprise_linux:8, redhat:enterprise_linux:9, redhat:enterprise_linux:10, redhat:rhel_e4s:9.0, redhat:rhel_e4s:9.2, redhat:rhel_eus:9.4, and redhat:openshift:4.

The CVSS score of 7.0 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploits are currently tracked. The attack vector is inferred to be local, as the flaw manifests when an attacker can invoke the genrb binary; a successful exploit would require local code execution or the ability to supply crafted data to the tool. While no active exploits are reported, the potential for local arbitrary code execution poses a significant risk in environments where genrb is run unattended or with untrusted input.