CVE-2011-4599: Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for...

Security readout for executives and security teams

This is a memory corruption flaw in ICU, a common Unicode library used inside many operating systems and applications. A crafted locale identifier can overflow stack memory and may allow remote code execution in software that passes attacker-controlled locale data to vulnerable ICU versions before 49.1. Exposure is most likely in legacy systems, applications, browsers, or operating-system packages that bundle ICU before 49.1. The source bundle lists multiple vendor advisories, indicating downstream distribution impact, but it does not enumerate exact affected application versions beyond ICU before 49.1. Prioritize remediation for legacy or externally reachable systems because the flaw is described as remote code execution. Urgency is high where ICU processes untrusted locale data, but current evidence does not show known active exploitation. Mitigation focus: Upgrade ICU to version 49.1 or later where directly managed.; Apply relevant vendor security updates for affected operating systems and bundled ICU packages.; Prioritize internet-facing software that accepts or processes user-controlled locale identifiers..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.