CVE-2026-111269

EUVD-2026-102524
libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.1 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
libical_projectlibical
𝑥
≤ 4.0.6
CNA
Debian logo
Debian Releases
Debian Product
Codename
libical3
bookworm
undetermined
forky
undetermined
sid
undetermined
trixie
undetermined
Common Weakness Enumeration
References
https://github.com/libical/libical
https://github.com/libical/libical/blob/9cfca65c122fa23b9680a28e0c9225a2fd015fc5/src/libical/icalvalue.c#L1608-L1645
https://github.com/libical/libical/commit/d753885ce2de7c105d6b8c405aa7aee1d98ad8de
https://github.com/libical/libical/pull/1455
https://hackmd.io/@haind-pwn/libical-icalvalue-decode-ical-string-oob-read
https://www.vulncheck.com/advisories/libical-through-4.0.6-heap-out-of-bounds-read-via-icalvalue-decode-ical-string