Every CVE Search/ Get API key

CVE-2016-7415

Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components...

9.8 CriticalFix available

Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

5.80%Up 4.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.

Record
CVE-2016-7415
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.

Record
CVE-2016-7415
Updated
2026-11-02
EUVDEUVD-2016-8268 No score

Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.

Record
EUVD-2016-8268
Updated
2026-11-03
GitHub AdvisoriesGHSA-7xfm-mgrj-8566 9.8

Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components...

Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.

Record
GHSA-7xfm-mgrj-8566
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02
OSVALPINE-CVE-2016-7415 9.8

Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.

Record
ALPINE-CVE-2016-7415
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2016-7415 9.8

CVE-2016-7415 does not affect BellSoft software

Record
BELL-CVE-2016-7415
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSV 9.8

Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.

Record
CVE-2016-7415
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-7415 9.8

Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.

Record
DEBIAN-CVE-2016-7415
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2016-7415 9.8

Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.

Record
UBUNTU-CVE-2016-7415
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2016-0404 No score

Updated icu packages fix security vulnerability

Stack overflow in ures_getByKeyWithFallback() in ICU before 54.1 could lead to a crash (CVE-2014-9911).

It was found that a big locale string causes a stack based overflow inside libicu in locid.cpp (CVE-2016-7415)

Record
MGASA-2016-0404
Updated
2026-11-02
OSVUSN-3227-1 No score

icu vulnerabilities

It was discovered that ICU incorrectly handled certain memory operations when processing data. If an application using ICU processed crafted data, a remote attacker could possibly cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program.

Record
USN-3227-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
icu
Alpine:v3.10
 before 58.1-r1
58.1-r1
icu
Alpine:v3.11
 before 58.1-r1
58.1-r1
icu
Alpine:v3.12
 before 58.1-r1
58.1-r1
icu
Alpine:v3.13
 before 58.1-r1
58.1-r1
icu
Alpine:v3.14
 before 58.1-r1
58.1-r1
icu
Alpine:v3.15
 before 58.1-r1
58.1-r1
icu
Alpine:v3.16
 before 58.1-r1
58.1-r1
icu
Alpine:v3.17
 before 58.1-r1
58.1-r1
icu
Alpine:v3.18
 before 58.1-r1
58.1-r1
icu
Alpine:v3.19
 before 58.1-r1
58.1-r1
Show 18 moreShow less
Affected packages
PackageAffectedFixed
icu
Alpine:v3.20
 before 58.1-r1
58.1-r1
icu
Alpine:v3.21
 before 58.1-r1
58.1-r1
icu
Alpine:v3.22
 before 58.1-r1
58.1-r1
icu
Alpine:v3.23
 before 58.1-r1
58.1-r1
icu
Alpine:v3.24
 before 58.1-r1
58.1-r1
icu
Alpine:v3.5
 before 57.1-r2
57.1-r2
icu
Alpine:v3.6
 before 58.1-r1
58.1-r1
icu
Alpine:v3.7
 before 58.1-r1
58.1-r1
icu
Alpine:v3.8
 before 58.1-r1
58.1-r1
icu
Alpine:v3.9
 before 58.1-r1
58.1-r1
icu
Debian:12
 before 57.1-5
57.1-5
icu
Debian:13
 before 57.1-5
57.1-5
icu
Debian:14
 before 57.1-5
57.1-5
icu
Debian:7
 before 4.8.1.1-12+deb7u6, plus listed versions
4.8.1.1-124.8.1.1-12+deb7u14.8.1.1-12+deb7u24.8.1.1-12+deb7u34.8.1.1-12+deb7u44.8.1.1-12+deb7u5
4.8.1.1-12+deb7u6
icu
Debian:8
 before 52.1-8+deb8u4, plus listed versions
52.1-852.1-8+deb8u252.1-8+deb8u3
52.1-8+deb8u4
icu
Mageia:5
 before 53.1-12.6.mga5
53.1-12.6.mga5
icu
Ubuntu:14.04:LTS
 before 52.1-3ubuntu0.5, plus listed versions
4.8.1.1-12ubuntu24.8.1.1-13+nmu14.8.1.1-13+nmu1ubuntu152.1-352.1-3ubuntu0.252.1-3ubuntu0.352.1-3ubuntu0.4
52.1-3ubuntu0.5
icu
Ubuntu:16.04:LTS
 before 55.1-7ubuntu0.1, plus listed versions
55.1-4ubuntu155.1-6ubuntu155.1-7
55.1-7ubuntu0.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-7415 is a critical vulnerability (CVSS 9.8) in Icu-project International Components For Unicode, published September 17, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.80%, the 93rd percentile. Fixed in icu 58.1-r1.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open