libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind. When parsing iCalendar data that includes a parameterized property, the function passes icalparameter_compare_kind_map to bsearch through a mismatched comparator function pointer type. bsearch invokes the callback through the mismatched type, which results in undefined behavior and causes the process to terminate, leading to a denial of service.

The vulnerability affects the libical library, specifically version 4.0.6. The description does not list additional product variants or affected operating systems, but any system that incorporates this libical version into its calendar parsing stack is potentially impacted.

The CVSS score of 6.2 indicates a medium severity denial of service. The EPSS score is less than 1%, and the vulnerability is not listed in KEV, suggesting low likelihood of widespread exploitation. The undefined behavior causing a crash indicates a clear denial of service risk. Based on the description, an attacker could supply crafted iCalendar data—such as over HTTP or a file upload—to trigger the bug. The exploit is local to the component that processes the data, but a vulnerable system exposed to external calendar feeds could suffer a denial of service.