CVE-2014-8146

CVE-2014-8146 is a high-severity vulnerability in Apple Itunes with a CVSS 2.0 base score of 7.5. Its EPSS exploit-prediction score of 24% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-119.

Key facts

• Severity: High (CVSS 2.0 base score 7.5)
• EPSS exploit prediction: 24% (98th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-119
• Affected product: Apple Itunes
• Published: 2015-05-25
• Last modified: 2026-06-17

Description

The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 does not properly track directionally isolated pieces of text, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via crafted text.

Frequently asked questions

What is CVE-2014-8146?

The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 does not properly track directionally isolated pieces of text, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via crafted text.

How severe is CVE-2014-8146?

CVE-2014-8146 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2014-8146 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 24% (98th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2014-8146?

CVE-2014-8146 primarily affects Apple Itunes. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2014-8146?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2014-8146 published?

CVE-2014-8146 was published on 2015-05-25 and last updated on 2026-06-17.

References

• http://bugs.icu-project.org/trac/changeset/37162
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00003.html
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
• http://openwall.com/lists/oss-security/2015/05/05/6
• http://seclists.org/fulldisclosure/2015/May/14
• http://www.debian.org/security/2015/dsa-3323
• http://www.kb.cert.org/vuls/id/602540
• http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
• http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
• http://www.securityfocus.com/bid/74457
• https://raw.githubusercontent.com/pedrib/PoC/master/generic/i-c-u-fail.txt
• https://security.gentoo.org/glsa/201507-04
• https://support.apple.com/HT205212
• https://support.apple.com/HT205213
• https://support.apple.com/HT205221
• https://support.apple.com/HT205267
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Affected products (5)

• cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:*
• cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
• cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
• cpe:2.3:a:icu-project:international_components_for_unicode:*:*:*:*:*:c\/c\+\+:*:*

More vulnerabilities in Apple Itunes

• CVE-2019-6235 — Critical (CVSS 10.0): A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, macOS Mojave…
• CVE-2010-1769 — Critical (CVSS 10.0): WebKit in Apple iTunes before 9.2 on Windows, and Apple iOS before 4 on the iPhone and iPod touch, accesses…
• CVE-2010-1763 — Critical (CVSS 10.0): Unspecified vulnerability in WebKit in Apple iTunes before 9.2 on Windows has unknown impact and attack vectors, a…
• CVE-2022-26711 — Critical (CVSS 9.8): An integer overflow issue was addressed with improved input validation. This issue is fixed in tvOS 15.5, iTunes…
• CVE-2019-8756 — Critical (CVSS 9.8): Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Catalina…
• CVE-2019-8749 — Critical (CVSS 9.8): Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Catalina…

All CVEs affecting Apple Itunes →

Other CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities

• CVE-2026-2778 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in…
• CVE-2026-2776 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability…
• CVE-2025-1866 — Critical (CVSS 10.0): Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows…
• CVE-2022-27625 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2022-27624 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2020-11896 — Critical (CVSS 10.0): The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

Browse all CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities →