What’s Vulnerable › Vulnerabilities

CVE-2020-10531

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-03-12 · updated 2026-10-14
• Weakness: CWE-190

Description

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

Affected products

• Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 19.10
• Debian Linux: 8.0, 9.0, 10.0
• Fedoraproject Fedora: 30, 31, 33
• Google Chrome: before 80.0.3987.122 — fixed in 80.0.3987.122
• Icu-Project International Components For Unicode: through 66.1
• Node.js: from 10.0.0 through 10.12.0; from 10.13.0 before 10.21.0 — fixed in 10.21.0
• openSUSE Leap: 15.1
• Oracle Banking Extensibility Workbench: 14.3.0, 14.4.0
• RedHat Enterprise Linux Desktop: 6.0
• RedHat Enterprise Linux Server: 6.0
• RedHat Enterprise Linux Workstation: 6.0

How to fix

Upgrade to a fixed version: Google Chrome 80.0.3987.122; Node.js 10.21.0. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00004.html
• https://access.redhat.com/errata/RHSA-2020:0738
• https://bugs.chromium.org/p/chromium/issues/detail?id=1044570
• https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.html
• https://chromium.googlesource.com/chromium/deps/icu/+/9f4020916eb1f28f3666f018fdcbe6c9a37f0e08
• https://github.com/unicode-org/icu/commit/b7d08bc04a4296982fcef8b6b8a354a9e4e7afca
• https://github.com/unicode-org/icu/pull/971
• https://lists.debian.org/debian-lts-announce/2020/03/msg00024.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3B5RWJQD5LA45MYLLR55KZJOJ5NVZGP/
• https://security.gentoo.org/glsa/202003-15

Get alerted when CVE-2020-10531 or the next vulnerability affects your stack