OESA-2026-4551: libical security update
Libical is an open source implementation of the IETF's iCalendar calendaring and scheduling protocols (RFC 2445, 2446, and 2447). It parses iCal components and provides a C API for manipulating the component properties, parameters, and subcomponents. Security Fix(es):
libical through 4.0.6 contains a heap-based out-of-bounds read in icalvaluedecodeicalstring() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.(CVE-2026-111269)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/libicalto a version that resolves this vulnerability.Fixed in 3.0.17-4.oe2403sp4
Event History
Frequently Asked Questions
What input is required to trigger the issue?
An attacker must cause the application to decode escaped iCalendar text that ends with a trailing backslash. The flaw occurs in libical's icalvalue_decode_ical_string() function.
What could exploitation cause?
The out-of-bounds heap read can crash the application, creating a denial-of-service condition. It may also leak adjacent heap memory.
Is user interaction required?
Yes. The supplied severity vector includes UI:R, indicating that user interaction is required. The vector also indicates local attack access and no privileges required.
Which libical versions are affected?
The issue is described as affecting libical through version 4.0.6. The provided data does not identify a fixed version.