CVE-2014-7940: The collator implementation in i18n/ucol.cpp in International Components for Unicode (ICU) 52 through SVN r...

Security readout for executives and security teams

This CVE is a memory-initialization flaw in ICU text collation, used by older Google Chrome and packaged by multiple vendors. A crafted character sequence could remotely crash affected software, and the record leaves other impact unspecified. There is no KEV listing and no source here proving active exploitation. Exposure is most likely in obsolete Chrome builds before 40.0.2214.91 or legacy systems using affected ICU packages from 2015-era distributions or Oracle products. The bundle does not provide a complete product inventory, so validate through package and browser version records. Medium priority for most organizations unless legacy browsers or unpatched ICU-dependent platforms remain in production. The main confirmed business risk is service disruption from crafted text input, with incomplete evidence for broader impact. Mitigation focus: Upgrade Chrome to 40.0.2214.91 or later where applicable.; Apply ICU-related security updates from the relevant OS or vendor advisory.; Check Oracle product guidance where Oracle software embeds affected ICU code..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.