libical through 4.0.6 contains a heap-based out-of-bounds read in icalvaluedecodeicalstring() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.

libical 4.0.6 contains an incompatible function pointer in icalparameterstringtokind(). When parsing iCalendar data containing a parameterized property, the function passes icalparametercomparekindmap() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.