Every CVE Search/ Get API key

CVE-2014-9654

The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before...

9.8 CriticalFix available

CVE-2014-9654 is a critical vulnerability (CVSS 9.8) in Google Chrome, published February 5, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.42%, the 84th percentile. Fixed in icu 52.1-7.1.

The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.42%Up 0.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.

Record
CVE-2014-9654
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.

Record
CVE-2014-9654
Updated
2026-11-02
EUVDEUVD-2014-9464 No score

The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.

Record
EUVD-2014-9464
Updated
2026-11-03
GitHub AdvisoriesGHSA-7p8r-35pv-r5w2 9.8

The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before...

The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.

Record
GHSA-7p8r-35pv-r5w2
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02
OSV 9.8

The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.

Record
CVE-2014-9654
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2014-9654 9.8

The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.

Record
DEBIAN-CVE-2014-9654
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2014-9654 9.8

The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.

Record
UBUNTU-CVE-2014-9654
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVSUSE-SU-2015:0458-1 No score

Security update for icu

icu was updated to fix one security issue.

This security issue was fixed:

  • CVE-2014-9654: Insufficient size limit checks in regular expression compiler (bnc#917129).
Record
SUSE-SU-2015:0458-1
Updated
2026-11-02
OSVSUSE-SU-2015:1144-1 No score

Security update for icu

This update fixes the following security issue in icu:

* CVE-2014-9654: insufficient size limit checks in regular expression
  compiler (bsc#917129)

Security Issues:

* CVE-2014-9654
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9654>
Record
SUSE-SU-2015:1144-1
Updated
2026-11-02
OSVSUSE-SU-2015:1790-1 No score

Security update for icu

icu was updated to fix one security issue.

This security issue was fixed:

  • CVE-2014-9654: Insufficient size limit checks in regular expression compiler (bsc#917129).
Record
SUSE-SU-2015:1790-1
Updated
2026-11-02
OSVSUSE-SU-2016:1090-1 No score

Security update for icu

This update for icu fixes the following issue:

The previous patch for CVE-2014-9654 was incorrect and lead to non-working regular expressions. This update fixes this problem (bsc#952260)

Record
SUSE-SU-2016:1090-1
Updated
2026-11-02
OSVUSN-2522-1 No score

icu vulnerabilities

It was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-1569, CVE-2013-2383, CVE-2013-2384, CVE-2013-2419)

It was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-6585, CVE-2014-6591)

It was discovered that ICU incorrectly handled memory operations when processing regular expressions. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-7923, CVE-2014-7926, CVE-2014-9654)

It was discovered that ICU collator implementation incorrectly handled memory operations. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-7940)

Record
USN-2522-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
icu
Debian:12
 before 52.1-7.1
52.1-7.1
icu
Debian:13
 before 52.1-7.1
52.1-7.1
icu
Debian:14
 before 52.1-7.1
52.1-7.1
icu
Debian:6.0
 before 4.4.1-8+squeeze3, plus listed versions
4.4.1-74.4.1-84.4.1-8+squeeze14.4.1-8+squeeze2
4.4.1-8+squeeze3
icu
Debian:7
 before 4.8.1.1-12+deb7u2, plus listed versions
4.8.1.1-124.8.1.1-12+deb7u1
4.8.1.1-12+deb7u2
chromium-browser
Red Hat:rhel_extras:6
 before 0:40.0.2214.91-1.el6_6
0:40.0.2214.91-1.el6_6
chromium-browser-debuginfo
Red Hat:rhel_extras:6
 before 0:40.0.2214.91-1.el6_6
0:40.0.2214.91-1.el6_6
icu
SUSE:Linux Enterprise Desktop 12
 before 52.1-7.1
52.1-7.1
icu
SUSE:Linux Enterprise Software Development Kit 12
 before 52.1-7.1
52.1-7.1
icu
SUSE:Linux Enterprise Server 12
 before 52.1-7.1
52.1-7.1
Show 10 moreShow less
Affected packages
PackageAffectedFixed
icu
SUSE:Linux Enterprise Server for SAP Applications 12
 before 52.1-7.1
52.1-7.1
icu
SUSE:Linux Enterprise Workstation Extension 12
 before 52.1-7.1
52.1-7.1
icu
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 4.0-7.30.2
4.0-7.30.2
icu
SUSE:Linux Enterprise Desktop 11 SP4
 before 4.0-7.30.2
4.0-7.30.2
icu
SUSE:Linux Enterprise Server 11 SP4
 before 4.0-7.30.2
4.0-7.30.2
icu
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 4.0-7.30.2
4.0-7.30.2
icu
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 4.0-38.1
4.0-38.1
icu
SUSE:Linux Enterprise Server 11 SP4
 before 4.0-38.1
4.0-38.1
icu
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 4.0-38.1
4.0-38.1
icu
Ubuntu:14.04:LTS
 before 52.1-3ubuntu0.2, plus listed versions
4.8.1.1-12ubuntu24.8.1.1-13+nmu14.8.1.1-13+nmu1ubuntu152.1-3
52.1-3ubuntu0.2

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 143 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open