CVE-2026-88383

EUVD-2026-86316
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
Type Confusion
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.2 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 10.15%
Debian logo
Debian Releases
Debian Product
Codename
libical3
bookworm
unimportant
forky
unimportant
sid
unimportant
trixie
unimportant
Azure Linux logo
Azure Linux Releases
Azure Package
Release
libical
Azure Linux 3.0
0:3.0.10-3.azl3
fixed