CVE-2026-111269: libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string
libical through 4.0.6 contains a heap-based out-of-bounds read in icalvaluedecodeicalstring() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.
Affected Software
Event History
Frequently Asked Questions
What input is required to trigger the flaw?
An attacker must cause the application to decode escaped iCalendar text whose input ends with a backslash. The vulnerable decoding loop then reads beyond the string terminator.
Is remote exploitation implied by the CVSS vector?
No. The provided CVSS vector specifies local attack vector (AV:L) and user interaction required (UI:R). It also specifies that no privileges are required (PR:N).
What are the likely effects if exploitation succeeds?
The out-of-bounds read can crash the application, affecting availability, or disclose adjacent heap memory. The provided severity vector indicates low confidentiality impact, no integrity impact, and high availability impact.
Which libical versions are known to be affected?
libical through version 4.0.6 is identified as affected. The supplied data does not state the first fixed release.