CVE-2014-9911: Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in Internation...

Security readout for executives and security teams

This is an old ICU C/C++ library flaw where specially crafted locale-display data could overflow stack memory. The documented outcome is denial of service, with other impact not specified. Business risk depends on whether products still ship ICU before 54.1 and process untrusted locale values. Likely exposure is legacy systems, applications, or downstream products using ICU C/C++ before 54.1. Public bundle data does not enumerate affected CPEs, so exposure must be confirmed through dependency inventory and vendor package advisories. Handle as a legacy dependency risk. It is not KEV-listed in the supplied data, but remote denial of service against exposed services can still create operational impact. Prioritize based on internet exposure and dependency age. Mitigation focus: Inventory ICU C/C++ versions across applications, OS packages, and embedded dependencies.; Upgrade applicable ICU deployments to 54.1 or later.; Apply downstream vendor updates where ICU is packaged inside another product..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.