--- id: CVE-2020-10531 title: >- An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1 summary: >- An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H' cwe: - CWE-190 - CWE-787 vendor: icu-project product: international_components_for_unicode affected: - international_components_for_unicode <= 66.1 - enterprise_linux_desktop = 6.0 - enterprise_linux_server = 6.0 - enterprise_linux_workstation = 6.0 - chrome < 80.0.3987.122 - fedora = 30 - fedora = 31 - fedora = 33 - debian_linux = 8.0 - debian_linux = 9.0 - debian_linux = 10.0 - ubuntu_linux = 12.04 - ubuntu_linux = 14.04 - ubuntu_linux = 16.04 - ubuntu_linux = 18.04 - ubuntu_linux = 19.10 - leap = 15.1 - banking_extensibility_workbench = 14.3.0 - banking_extensibility_workbench = 14.4.0 - 'node.js >= 10.0.0, <= 10.12.0' - 'node.js >= 10.13.0, < 10.21.0' patched: - chrome 80.0.3987.122 - node.js 10.21.0 published: '2020-03-12' updated: '2026-10-14' sourceUpdated: '2026-10-14T09:17:16.753' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-10531' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00004.html' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2020:0738' label: cve@mitre.org - url: 'https://bugs.chromium.org/p/chromium/issues/detail?id=1044570' label: cve@mitre.org - url: >- https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.html label: cve@mitre.org - url: >- https://chromium.googlesource.com/chromium/deps/icu/+/9f4020916eb1f28f3666f018fdcbe6c9a37f0e08 label: cve@mitre.org - url: >- https://github.com/unicode-org/icu/commit/b7d08bc04a4296982fcef8b6b8a354a9e4e7afca label: cve@mitre.org - url: 'https://github.com/unicode-org/icu/pull/971' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2020/03/msg00024.html' label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3B5RWJQD5LA45MYLLR55KZJOJ5NVZGP/ label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202003-15' label: cve@mitre.org - url: 'https://unicode-org.atlassian.net/browse/ICU-20958' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4305-1/' label: cve@mitre.org - url: 'https://www.debian.org/security/2020/dsa-4646' label: cve@mitre.org - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00004.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2020:0738' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugs.chromium.org/p/chromium/issues/detail?id=1044570' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://chromium.googlesource.com/chromium/deps/icu/+/9f4020916eb1f28f3666f018fdcbe6c9a37f0e08 label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/unicode-org/icu/commit/b7d08bc04a4296982fcef8b6b8a354a9e4e7afca label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/unicode-org/icu/pull/971' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/03/msg00024.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3B5RWJQD5LA45MYLLR55KZJOJ5NVZGP/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202003-15' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://unicode-org.atlassian.net/browse/ICU-20958' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4305-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2020/dsa-4646' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-10531.json - url: 'https://access.redhat.com/security/cve/CVE-2020-10531' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1807349' - url: 'https://www.cve.org/CVERecord?id=CVE-2020-10531' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-10531' - url: 'https://access.redhat.com/errata/RHSA-2020:0896' - url: 'https://access.redhat.com/errata/RHSA-2020:0897' - url: 'https://access.redhat.com/errata/RHSA-2020:3084' - url: 'https://access.redhat.com/errata/RHSA-2020:2895' - url: 'https://access.redhat.com/errata/RHSA-2020:1343' - url: 'https://access.redhat.com/errata/RHSA-2020:1317' - url: 'https://access.redhat.com/errata/RHSA-2020:1293' - url: 'https://access.redhat.com/errata/RHSA-2020:0901' - url: 'https://access.redhat.com/errata/RHSA-2020:0902' tags: - nvd - csaf - vex - red-hat epss: 0.02669 epssPercentile: 0.8538 ingestedAt: '2026-10-14T09:24:26.053Z' --- ## Overview An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. ## Affected - `international_components_for_unicode <= 66.1` - `enterprise_linux_desktop = 6.0` - `enterprise_linux_server = 6.0` - `enterprise_linux_workstation = 6.0` - `chrome < 80.0.3987.122` - `fedora = 30` - `fedora = 31` - `fedora = 33` - `debian_linux = 8.0` - `debian_linux = 9.0` - `debian_linux = 10.0` - `ubuntu_linux = 12.04` - `ubuntu_linux = 14.04` - `ubuntu_linux = 16.04` - `ubuntu_linux = 18.04` - `ubuntu_linux = 19.10` - `leap = 15.1` - `banking_extensibility_workbench = 14.3.0` - `banking_extensibility_workbench = 14.4.0` - `node.js >= 10.0.0, <= 10.12.0` - `node.js >= 10.13.0, < 10.21.0` ## Remediation Upgrade past the affected range: - `chrome 80.0.3987.122` - `node.js 10.21.0` ## Vendor advisories - **RHSA-2020:0896** · Red Hat · fixed in: Red Hat Enterprise Linux Desktop (v. 6), Red Hat Enterprise Linux Desktop Optional (v. 6), Red Hat Enterprise Linux HPC Node (v. 6), Red Hat Enterprise Linux HPC Node Optional (v. 6), Red Hat Enterprise Linux Server (v. 6), Red Hat Enterprise Linux Server Optional (v. 6), … · released 2020-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2020:0896) - **RHSA-2020:0738** · Red Hat · fixed in: Red Hat Enterprise Linux Desktop Supplementary (v. 6), Red Hat Enterprise Linux HPC Node Supplementary (v. 6), Red Hat Enterprise Linux Server Supplementary (v. 6), Red Hat Enterprise Linux Workstation Supplementary (v. 6) · released 2020-03-09 · [advisory](https://access.redhat.com/errata/RHSA-2020:0738) - **RHSA-2020:0897** · Red Hat · fixed in: Red Hat Enterprise Linux Client (v. 7), Red Hat Enterprise Linux Client Optional (v. 7), Red Hat Enterprise Linux ComputeNode (v. 7), Red Hat Enterprise Linux ComputeNode Optional (v. 7), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux Server Optional (v. 7), … · released 2020-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2020:0897) - **RHSA-2020:3084** · Red Hat · fixed in: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7), Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) · released 2020-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2020:3084) - **RHSA-2020:2895** · Red Hat · fixed in: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7), Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) · released 2020-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2020:2895) - **RHSA-2020:1343** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v. 8.0) · released 2020-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2020:1343) - **RHSA-2020:1317** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2020-04-06 · [advisory](https://access.redhat.com/errata/RHSA-2020:1317) - **RHSA-2020:1293** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2020-04-02 · [advisory](https://access.redhat.com/errata/RHSA-2020:1293) - **RHSA-2020:0901** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS E4S (v. 8.0) · released 2020-03-19 · [advisory](https://access.redhat.com/errata/RHSA-2020:0901) - **RHSA-2020:0902** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8) · released 2020-03-19 · [advisory](https://access.redhat.com/errata/RHSA-2020:0902) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 5 · no fix planned: Red Hat Enterprise Linux 5 · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-10531.json)