CVE-2026-88383: Libical libical vulnerability
libical 4.0.6 contains an incompatible function pointer in icalparameterstringtokind(). When parsing iCalendar data containing a parameterized property, the function passes icalparametercomparekindmap() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
Affected Software
Event History
Frequently Asked Questions
What input is needed to trigger the denial of service?
The affected code path is reached while parsing iCalendar data that contains a parameterized property. An attacker would need to cause a vulnerable libical consumer to parse such data.
What is the observable impact of successful exploitation?
The incompatible comparator callback passed to bsearch() causes undefined behavior when invoked. The reported outcome is process termination, resulting in a denial of service.
How can I determine whether an application may be affected?
Check whether the application uses libical 4.0.6 and parses externally supplied or otherwise untrusted iCalendar data. Review whether that parsing can process properties with parameters.