OESA-2026-4552: libical security update

Q: What systems are realistically exposed to this issue?

Applications using libical to decode attacker-controlled iCalendar text are exposed, particularly where untrusted calendar content can be imported or processed. The affected behavior is present in libical through version 4.0.6.

Q: What does an attacker need to exploit the flaw?

An attacker needs to cause the application to decode escaped iCalendar text that ends with a trailing backslash. The supplied vector indicates local attack access and user interaction are required, while no privileges are required.

Q: What is the likely impact of successful exploitation?

The out-of-bounds heap read can crash the application, resulting in a denial of service. It may also disclose adjacent heap memory, which creates a confidentiality impact.

Q: How can I determine whether my application may be affected?

Check whether the application uses libical version 4.0.6 or earlier and processes iCalendar input. Test or review handling of escaped iCalendar strings that end in a backslash, as these can trigger the vulnerable decode path.

Published Oct 29, 2026

Updated

Libical is an open source implementation of the IETF&apos;s iCalendar calendaring and scheduling protocols (RFC 2445, 2446, and 2447). It parses iCal components and provides a C API for manipulating the component properties, parameters, and subcomponents. Security Fix(es):

libical through 4.0.6 contains a heap-based out-of-bounds read in icalvaluedecodeicalstring() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.(CVE-2026-111269)

Affected Software

1 affected componentFixes available

openeuler/libical<3.0.11-4.oe2203sp4

3.0.11-4.oe2203sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/libical to a version that resolves this vulnerability.
Fixed in 3.0.11-4.oe2203sp4

Event History

Oct 29, 2026

Advisory Published

via OSV·09:02 AM

Data Sourced

via OSV·09:02 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-111269

Frequently Asked Questions

What systems are realistically exposed to this issue?

Applications using libical to decode attacker-controlled iCalendar text are exposed, particularly where untrusted calendar content can be imported or processed. The affected behavior is present in libical through version 4.0.6.

What does an attacker need to exploit the flaw?

An attacker needs to cause the application to decode escaped iCalendar text that ends with a trailing backslash. The supplied vector indicates local attack access and user interaction are required, while no privileges are required.

What is the likely impact of successful exploitation?

The out-of-bounds heap read can crash the application, resulting in a denial of service. It may also disclose adjacent heap memory, which creates a confidentiality impact.

How can I determine whether my application may be affected?

Check whether the application uses libical version 4.0.6 or earlier and processes iCalendar input. Test or review handling of escaped iCalendar strings that end in a backslash, as these can trigger the vulnerable decode path.

OESA-2026-4552: libical security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What systems are realistically exposed to this issue?

What does an attacker need to exploit the flaw?

What is the likely impact of successful exploitation?

How can I determine whether my application may be affected?

Company

Resources

Contact

Frequently Asked Questions

What systems are realistically exposed to this issue?

What does an attacker need to exploit the flaw?

What is the likely impact of successful exploitation?

How can I determine whether my application may be affected?