CVE-2026-111269
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.
Risk Assessment
The vulnerability enables remote crashes of applications processing iCalendar data, potentially leading to denial of service or memory data leakage.
Recommendation
Upgrade libical beyond version 4.0.6 and fix the trailing backslash handling in icalvalue_decode_ical_string().
Other vulnerabilities in libical
See all- CVE-2016-5827High
The icaltime_from_string function in libical versions 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function.
- CVE-2016-5826High
The parser_get_next_char function in libical versions 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) by crafting a string to the icalparser_parse_string function.
- CVE-2016-9584Critical
Libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file.
- CVE-2026-88383Medium
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination.
Original NVD description (English source)
libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS