CVE-2016-5827
HighSummary
The icaltime_from_string function in libical versions 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function.
Risk Assessment
Attackers can exploit this vulnerability to disrupt application functionality, potentially leading to service outages.
Recommendation
It is recommended to update libical to the latest version to mitigate this vulnerability.
Other vulnerabilities in libical
See all- CVE-2016-5826High
The parser_get_next_char function in libical versions 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) by crafting a string to the icalparser_parse_string function.
- CVE-2016-9584Critical
Libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file.
- CVE-2026-88383Medium
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination.
Original NVD description (English source)
The icaltime_from_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS