Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-111269

libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string

libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Libical Libical Project
Products
Libical Libical
CVE-2026-88383

libical: libical: Denial of Service via crafted iCalendar property parsing

libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Libical
Products
Libical