HOME VULNERABILITIESCVE-2020-10531

HIGH

CVE-2020-10531

CWE-190Published: March 12, 2020· Updated: Jun 17, 2026

8.8

CVSS v3.1

Official Description

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

Technical Analysis

CVE-2020-10531 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionRequired

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Vendors & Products

Canonical1 product(s)

ubuntu linux

Debian1 product(s)

debian linux

Fedora1 product(s)

fedora

Google1 product(s)

chrome

icu-project1 product(s)

international components for unicode

Node.js1 product(s)

node.js

openSUSE1 product(s)

leap

Oracle1 product(s)

banking extensibility workbench

Red Hat3 product(s)

enterprise linux desktopenterprise linux serverenterprise linux workstation

Source: NVD CPE · 20 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

Security advisories & exploits

Official NIST entry

CVE Program entry

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://chromium.googlesource.com/chromium/deps/icu/+/9f4020916eb1f28f3666f018fdcbe6c9a37f0e08

PATCHhttps://github.com/unicode-org/icu/commit/b7d08bc04a4296982fcef8b6b8a354a9e4e7afca

PATCHhttps://github.com/unicode-org/icu/pull/971

PATCHhttps://www.oracle.com/security-alerts/cpujan2021.html

PATCHhttps://chromium.googlesource.com/chromium/deps/icu/+/9f4020916eb1f28f3666f018fdcbe6c9a37f0e08

PATCHhttps://github.com/unicode-org/icu/commit/b7d08bc04a4296982fcef8b6b8a354a9e4e7afca

PATCHhttps://github.com/unicode-org/icu/pull/971

PATCHhttps://www.oracle.com/security-alerts/cpujan2021.html

ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2020-04/msg00004.html

ADVISORYhttps://access.redhat.com/errata/RHSA-2020:0738

ADVISORYhttps://bugs.chromium.org/p/chromium/issues/detail?id=1044570

ADVISORYhttps://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.html

ADVISORYhttps://lists.debian.org/debian-lts-announce/2020/03/msg00024.html

ADVISORYhttps://security.gentoo.org/glsa/202003-15

ADVISORYhttps://unicode-org.atlassian.net/browse/ICU-20958

ADVISORYhttps://usn.ubuntu.com/4305-1/

ADVISORYhttps://www.debian.org/security/2020/dsa-4646

ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html

ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2022.html

ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2020-04/msg00004.html

ADVISORYhttps://access.redhat.com/errata/RHSA-2020:0738

ADVISORYhttps://bugs.chromium.org/p/chromium/issues/detail?id=1044570

ADVISORYhttps://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.html

ADVISORYhttps://lists.debian.org/debian-lts-announce/2020/03/msg00024.html

ADVISORYhttps://security.gentoo.org/glsa/202003-15

ADVISORYhttps://unicode-org.atlassian.net/browse/ICU-20958

ADVISORYhttps://usn.ubuntu.com/4305-1/

ADVISORYhttps://www.debian.org/security/2020/dsa-4646

ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html

ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2022.html

All References (36)

→

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00004.htmlMailing List · Third Party Advisory

→

https://access.redhat.com/errata/RHSA-2020:0738Third Party Advisory

→

https://bugs.chromium.org/p/chromium/issues/detail?id=1044570Permissions Required · Third Party Advisory

→

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.htmlThird Party Advisory

→

https://chromium.googlesource.com/chromium/deps/icu/+/9f4020916eb1f28f3666f018fdcbe6c9a37f0e08Patch · Third Party Advisory

→

https://github.com/unicode-org/icu/commit/b7d08bc04a4296982fcef8b6b8a354a9e4e7afcaPatch · Third Party Advisory

→

https://github.com/unicode-org/icu/pull/971Issue Tracking · Patch · Third Party Advisory

→

https://lists.debian.org/debian-lts-announce/2020/03/msg00024.htmlMailing List · Third Party Advisory

→

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/

→

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/

→

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3B5RWJQD5LA45MYLLR55KZJOJ5NVZGP/

→

https://security.gentoo.org/glsa/202003-15Third Party Advisory

→

https://unicode-org.atlassian.net/browse/ICU-20958Permissions Required · Third Party Advisory

→

https://usn.ubuntu.com/4305-1/Third Party Advisory

→

https://www.debian.org/security/2020/dsa-4646Third Party Advisory

Quick Facts

CVE IDCVE-2020-10531

CVSS Score8.8 / 10

SeverityHIGH

WeaknessCWE-190

CISA KEVNo

Affected9 vendor(s)

PublishedMar 12, 2020

Related CVEs (CWE-190)

Recommended Actions

→Apply vendor patches immediately
→Monitor CVE-2020-10531 in threat intel feeds
→Review IDS/IPS signatures for exploitation attempts

Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.

← All Vulnerabilities·Search for CVE-2020-10531·NVD