Description
libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.
Published: 2026-10-15
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Heap Out‑of‑Bounds Read leading to crashes or potential information leakage
Action: Apply Patch
AI Analysis

Impact

This flaw arises within the icalvalue_decode_ical_string function of libical versions up to 4.0.6 when it processes escaped iCalendar text that ends with a backslash. The routine reads beyond the intended data termination, resulting in a classic out‑of‑bounds read (CWE‑125). An attacker can deliver such crafted input, causing the application to crash or expose adjacent heap memory contents.

Affected Systems

libical:libical versions 4.0.6 and earlier are affected. The issue is documented for the libical project and has been fixed in later releases beyond 4.0.6.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. The EPSS score is < 1%, showing a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be any scenario where an application using libical receives external iCalendar data; therefore, programs such as email clients or calendar servers that parse remote input could be exploited. The moderate CVSS combined with the very low EPSS still warrants prompt remediation.

Generated by OpenCVE AI on October 16, 2026 at 16:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade libical to the latest release that includes the fix (e.g., 4.0.7 or later).
  • If an immediate upgrade cannot be performed, ensure that any iCalendar data passed to icalvalue_decode_ical_string is pre‑validated or sanitized to remove a trailing backslash before parsing.
  • Deploy the updated library or the patched application, and monitor system logs for crashes or abnormal memory access related to iCalendar processing.

Generated by OpenCVE AI on October 16, 2026 at 16:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 15 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Description libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.
Title libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string
First Time appeared Libical Project
Libical Project libical
Weaknesses CWE-125
CPEs cpe:2.3:a:libical_project:libical:*:*:*:*:*:*:*:*
Vendors & Products Libical Project
Libical Project libical
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Libical Project Libical
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T21:43:16.966Z

Reserved: 2026-10-15T19:33:18.967Z

Link: CVE-2026-111269

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-15T22:19:27.680

Modified: 2026-10-15T22:19:27.680

Link: CVE-2026-111269

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-15T21:43:16Z

Links: CVE-2026-111269 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T16:30:13Z

Weaknesses