CVE-2026-88383
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When...
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
- Record
CVE-2026-88383- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-843
- Updated
- 2026-11-02
EUVDEUVD-2026-86316
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
- Record
EUVD-2026-86316- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r8r2-rvrx-7xqq
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When...
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
- Record
GHSA-r8r2-rvrx-7xqq- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-843
- Updated
- 2026-11-02
NVD
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
- Record
CVE-2026-88383- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-843
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-88383
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
- Record
DEBIAN-CVE-2026-88383- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-4376
libical security update
Libical is an open source implementation of the IETF's iCalendar calendaring and scheduling protocols (RFC 2445, 2446, and 2447). It parses iCal components and provides a C API for manipulating the component properties, parameters, and subcomponents.
Security Fix(es):
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.(CVE-2026-88383)
- Record
OESA-2026-4376- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVOESA-2026-4377
libical security update
Libical is an open source implementation of the IETF's iCalendar calendaring and scheduling protocols (RFC 2445, 2446, and 2447). It parses iCal components and provides a C API for manipulating the component properties, parameters, and subcomponents.
Security Fix(es):
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.(CVE-2026-88383)
- Record
OESA-2026-4377- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-4378
libical security update
Libical is an open source implementation of the IETF's iCalendar calendaring and scheduling protocols (RFC 2445, 2446, and 2447). It parses iCal components and provides a C API for manipulating the component properties, parameters, and subcomponents.
Security Fix(es):
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.(CVE-2026-88383)
- Record
OESA-2026-4378- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-4379
libical security update
Libical is an open source implementation of the IETF's iCalendar calendaring and scheduling protocols (RFC 2445, 2446, and 2447). It parses iCal components and provides a C API for manipulating the component properties, parameters, and subcomponents.
Security Fix(es):
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.(CVE-2026-88383)
- Record
OESA-2026-4379- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-88383
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
- Record
UBUNTU-CVE-2026-88383- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-106797 No score
CVE-2026-88383 affecting package libical for versions less than 3.0.10-3
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
- Record
AZL-106797- Updated
- 2026-11-07
OSVMGASA-2026-0553 No score
Updated libical package fixes security vulnerabilities
Denial of Service via crafted iCalendar property parsing. (CVE-2026-88383) Heap Out-of-Bounds Read via icalvalue_decode_ical_string. (CVE-2026-111269)
- Record
MGASA-2026-0553- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libicalAzure Linux:3 |
before 3.0.10-3 | 3.0.10-3 |
libical3Debian:12 |
All versions, plus listed versions 3.0.16-13.0.17-13.0.17-1.13.0.17-1.1~exp13.0.18-1 Show 7 moreShow less3.0.19-13.0.19-23.0.19-33.0.19-43.0.20-13.0.20-23.0.20-3 |
None known |
libical3Debian:13 |
All versions, plus listed versions 3.0.20-13.0.20-23.0.20-3 |
None known |
libical3Debian:14 |
All versions, plus listed versions 3.0.20-13.0.20-23.0.20-3 |
None known |
libicalMageia:10 From an advisory covering 2 CVEs |
before 3.0.20-2.1.mga10 | 3.0.20-2.1.mga10 |
libicalopenEuler:22.03-LTS-SP4 |
before 3.0.11-3.oe2203sp4 | 3.0.11-3.oe2203sp4 |
libicalopenEuler:24.03-LTS-SP1 |
before 3.0.17-3.oe2403sp1 | 3.0.17-3.oe2403sp1 |
libicalopenEuler:24.03-LTS-SP3 |
before 3.0.17-3.oe2403sp3 | 3.0.17-3.oe2403sp3 |
libicalopenEuler:24.03-LTS-SP4 |
before 3.0.17-3.oe2403sp4 | 3.0.17-3.oe2403sp4 |
libicalUbuntu:16.04:LTS |
All versions, plus listed versions 1.0.1-0ubuntu11.0.1-0ubuntu2 |
None known |
libicalUbuntu:18.04:LTS |
All versions, plus listed versions 2.0.0-0.52.0.0-0.5build12.0.0-1ubuntu12.0.0-4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-88383 is a medium vulnerability (CVSS 6.2) in libical, published September 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. Fixed in libical 3.0.10-3.
References
github.com/libical/libical/issues/1361
nvd.nist.gov/vuln/detail/CVE-2026-88383
security-tracker.debian.org/tracker/CVE-2026-88383
Show 10 moreShow less
advisories.mageia.org/MGASA-2026-0553.html
bugs.mageia.org/show_bug.cgi?id=36475
lists.fedoraproject.org/archives/list/[email protected]/message/IS2XULHAXRU4HV4TBL2ALZSHAFHMXM5Y
bugzilla.redhat.com/show_bug.cgi?id=2540947
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4376
ubuntu.com/security/CVE-2026-88383
cve.org/CVERecord?id=CVE-2026-88383