CVE-2026-88383
Low risk· EPSS 5%Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination.
Risk Assessment
This can lead to denial of service when processing specially crafted iCalendar data.
Recommendation
Update libical to a patched version or restrict processing of untrusted iCalendar data.
Other vulnerabilities in libical
See all- CVE-2016-5827High
The icaltime_from_string function in libical versions 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function.
- CVE-2016-5826High
The parser_get_next_char function in libical versions 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) by crafting a string to the icalparser_parse_string function.
- CVE-2016-9584Critical
Libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file.
Original NVD description (English source)
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS