libical EUVD-2026-102524

Requires the application to feed attacker-controlled iCalendar text through the escaped-string decoding path (icalvalue_decode_ical_string, or icallangbind_property_eval_string) where a value ends in a trailing backslash (or newline) - e.g. a crafted .ics file, meeting invite, or subscribed calendar feed. Limiting factors: the CVSS vector is AV:L with UI:P, so a local victim must open or process the malicious calendar data; there is no remote-unauthenticated path in default use, and the primary outcome is a crash (DoS) with only limited adjacent heap disclosure rather than code execution. Any libical version at or below 4.0.6 that parses untrusted calendar input is in scope.

Signals point to a moderate, not urgent, priority. The CVSS 4.0 base score is 6.9 (MEDIUM) and the vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H) shows the dominant impact is availability (VA:H, an application crash) with only low confidentiality loss (VC:L, limited adjacent heap leakage) and no integrity impact - consistent with the CWE-125 out-of-bounds READ classification (there is no memory corruption/write primitive, so RCE is not indicated). Exploitation is gated by a local vector and passive user interaction (UI:P): a victim must process attacker-supplied iCalendar data, which lowers real-world risk versus a remote-unauthenticated flaw. No EPSS score, no CISA KEV listing, and no explicit POC flag were provided in the input, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis - though VulnCheck reported it and a detailed technical writeup exists on hackmd, which raises the likelihood that working reproduction steps are publicly derivable. Because no SSVC/EPSS/KEV data is present, risk is inferred from the CVSS vector alone: a realistic DoS plus minor info-leak in a widely embedded parsing library. Patch promptly where libical parses untrusted calendar input, but this is not a drop-everything critical issue.

An attacker sends a victim a malicious .ics calendar invitation or hosts a calendar feed containing escaped iCalendar text whose value ends in a trailing backslash. When the victim's libical-based client parses it, icalvalue_decode_ical_string() reads past the string terminator, crashing the application or leaking adjacent heap bytes into the decoded output. No weaponized public exploit is confirmed, but a technical writeup describing the bug exists.