CVE-2007-4770: libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences t...

Security readout for executives and security teams

This flaw affects ICU libicu 3.8.1 and earlier, a Unicode processing library embedded in many applications. A malformed regular expression using a nonexistent capture group zero can corrupt internal stack frames and may cause out-of-bounds memory reads or writes. Business risk depends on whether exposed software accepts untrusted input reaching ICU. Likely limited to legacy systems still running ICU/libicu 3.8.1 or earlier, or applications bundling those versions. References show downstream distribution and OpenOffice advisories, but the provided affected-product metadata is incomplete and lists no specific CPEs. Treat as a legacy dependency cleanup item with potentially serious memory-safety impact. It is not KEV-listed or proven actively exploited in the provided sources, so prioritize based on internet exposure, untrusted input handling, and unsupported software presence. Mitigation focus: Identify and retire ICU/libicu 3.8.1 and earlier wherever installed or bundled.; Apply vendor updates from the relevant OS or application provider.; Check OpenOffice and distribution advisories for packaged fixes affecting bundled ICU..

Prepared

Jun 28, 2026, 19:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.