ZeroDay Findings
Sign inSign up

Findings

CVE-2018-18928

International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.

Published Nov 4, 2018 · updated Oct 15, 2026 · icu-project international components for unicode

International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 4, 2018 · NIST NVD

    Detected

    International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.

  2. Oct 14, 2026 · NIST NVD

    Updated

    International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.

  3. Oct 14, 2026 · OSV.dev

    Fix available

    icu fixed in 63.1-3; icu fixed in 63.1-3; icu fixed in 63.1-3

  4. Oct 14, 2026 · OSV.dev

    Fix available

    icu fixed in 63.1-3

  5. Oct 14, 2026 · OSV.dev

    Updated

    International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.

  6. Oct 15, 2026 · OSV.dev

    Updated

    International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.

Affected

  • Debian:12 icu0 → 63.1-3
  • Debian:13 icu0 → 63.1-3
  • Debian:14 icu0 → 63.1-3
  • cpe icu-project/international components for unicode63.1

Sources

  • CVE.orgVulnerability recordCVE-2018-18928

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2018-18928

    30-day exploitation probability 2.9%

    first.org
  • NIST NVDVulnerability recordCVE-2018-18928

    International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.

    nvd.nist.gov
  • OSV.devPackage advisoryDEBIAN-CVE-2018-18928
    osv.dev

References