Skip to content
OpenAdvisories
Medium · 6.2 CVE-2026-88383 EUVD-2026-86316GHSA-r8r2-rvrx-7xqq

libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a paramet…

Published Sep 24, 2026 · Updated Oct 6, 2026 · Assigned by mitre

Description

libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libical3 No fix yet —
Debian 13 libical3 No fix yet —
Debian 12 libical3 No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS libical No fix yet —
Ubuntu 16.04 LTS libical No fix yet —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 libical 3.0.10-3 —

References