Unicode's vulnerability footprint is narrow, centered on International Components for Unicode and related Unicode-handling libraries that process and normalize character data across a wide range of downstream applications. The recurring weakness classes, including code injection, buffer overflows, missing encryption of sensitive data, and use-after-free conditions, reflect the parsing and memory-management demands inherent to character set transformation and validation. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Unicode over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-42574HIGH An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be | Nov 1, 2021 | 8.3 | 35 | NO | NO |
CVE-2021-42694HIGH An issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allows an adversary to produce source code identifiers such as fun | Nov 1, 2021 | 8.3 | 29 | NO | NO |
CVE-2025-5222HIGH A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. Thi | May 27, 2025 | 7.0 | 24 | NO | NO |
CVE-2016-10610HIGH unicode-json is a unicode lookup table. unicode-json before 2.0.0 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks. | Jun 1, 2018 | 8.1 | 22 | NO | NO |
CVE-2016-10578HIGH unicode loads unicode data downloaded from unicode.org into nodejs. Unicode before 9.0.0 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. | May 29, 2018 | 8.1 | 22 | NO | NO |
CVE-2020-21913MEDIUM International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.c | Sep 20, 2021 | 5.5 | 16 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Unicode.
Media articles that mention a CVE ID that affects a product developed by Unicode — matched by CVE ID, not by vendor name.