CVE-2026-88383
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination.
Risk Assessment
This can lead to denial of service when processing specially crafted iCalendar data.
Recommendation
Update libical to a patched version or restrict processing of untrusted iCalendar data.
Other vulnerabilities in libical
See all- CVE-2016-5827High
The icaltime_from_string function in libical versions 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function.
- CVE-2016-5826High
The parser_get_next_char function in libical versions 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) by crafting a string to the icalparser_parse_string function.
- CVE-2016-9584Critical
Libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file.
- CVE-2026-111269Medium
libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.
Original NVD description (English source)
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS