CVE-2014-9654: The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03,...

Security readout for executives and security teams

This is an old ICU regular expression vulnerability that can let a remote attacker crash affected software with a crafted string. Sources also mention possible unspecified impact, but do not define it. Business risk is highest where legacy products still bundle vulnerable ICU code. Exposure is most likely in legacy browsers, appliances, operating system packages, or applications embedding old ICU C/C++ libraries. Modern managed environments are mainly at risk if they ship frozen third-party ICU copies. Low urgency for fully patched modern environments; moderate priority for legacy estate cleanup. The main business concern is availability disruption or undefined memory corruption risk in products still carrying 2014-era ICU regex code. Mitigation focus: Upgrade ICU to a fixed release newer than the 2014-12-03 fix point.; Upgrade Google Chrome beyond 40.0.2214.91 where relevant.; Check vendor advisories for products bundling ICU, including OS and application vendors..

Prepared

Jun 13, 2026, 05:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.