EUVD-2026-86316
GHSA-r8r2-rvrx-7xqq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted parameterized iCalendar/vCard data
-
ExploitReach icalparameter_string_to_kind() parser path
-
ExecutionInvoke bsearch() via incompatible comparator pointer
-
ImpactAbort process (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Triggered when an application using libical 4.0.6 parses attacker-controlled iCalendar data (or vCard data via the libicalvcard path) containing a parameterized property, which routes through icalparameter_string_to_kind()/vcardparameter_string_to_kind() and calls bsearch() with the incompatibly-cast comparator. The primary limiting factor is build configuration: deterministic process termination requires libical to be compiled with Control Flow Integrity enforcement or a function-pointer-type sanitizer; on ordinary non-hardened builds the type-mismatched callback usually runs without aborting, so default distro builds may not crash. No authentication is required (CVSS PR:N) and no user interaction is encoded (UI:N), though in practice exposure depends on whether the consuming app parses untrusted calendar content automatically or on user action. |
| Impact | This is a low-priority, high-noise issue despite a Medium CVSS of 6.2. All signals point to limited real-world risk: EPSS is 0.17% (5th percentile - very low predicted exploitation), there is no CISA KEV listing, and no public exploit code was identified. The impact is confined to availability (CVSS C:N/I:N/A:H) - a process crash/denial of service via CWE-843 type confusion, with no path to code execution or data disclosure. A key technical nuance limits severity further: an incompatible function-pointer cast passed to bsearch() is technically undefined behavior, but on virtually all mainstream compilers/ABIs the mismatched comparator executes harmlessly; reliable 'process termination' typically only occurs when libical is built with Control Flow Integrity (e.g. clang -fsanitize=cfi-icall) or a UBSan function-pointer check - so the crash is build-configuration-dependent rather than universal. Signal conflict to verify: NVD scored AV:L (local), but libical is a parsing library that commonly ingests remotely-delivered iCalendar/vCard content (email invites, CalDAV sync), implying the realistic vector is network-adjacent - verify actual exposure against how the consuming application feeds data. Net: a genuine robustness bug worth patching in hardened builds, but not an urgent, widely-exploitable threat. |
| Exploit ScenarioDerived | An attacker sends a crafted iCalendar (or vCard) object containing a parameterized property - for example as an email calendar invite or via a CalDAV feed - to an application that parses it with libical 4.0.6. During parsing, icalparameter_string_to_kind() invokes bsearch() through a type-mismatched comparator pointer; on a CFI/UBSan-hardened build this aborts the process, denying service. No public proof-of-concept exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Parsing attacker-controlled iCalendar data containing a parameterized property in libical 4.0.6 can terminate the consuming process, because icalparameter_string_to_kind() passes an incompatibly-cast comparator to bsearch(); the same defect exists in the libicalvcard path via vcardparameter_string_to_kind(). No authentication is required (CVSS PR:N) and no user interaction is encoded (UI:N), but exploitation hinges on the target being built with Control Flow Integrity enforcement or a function-pointer-type sanitizer, since type-confusion callbacks usually execute without aborting on ordinary non-hardened distro builds, and in practice a library needs to be fed untrusted calendar content by an application that parses it automatically or on user action. Independent assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (input data lists 6.2 at AV:L), EPSS is only 0.17% (5th percentile), and no public exploit code has been identified at time of analysis; the issue is best characterized as a low-priority, high-noise type-confusion defect rather than a broadly exploitable denial-of-service vector.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed. The authoritative remediation is to adopt the upstream change in https://github.com/libical/libical/pull/1363 (commit 557d9c043733b33a8511dce41fdeeb508460d5a9), which replaces the incompatible bsearch() comparator with correctly typed static wrappers s_icalparameter_compare_kind_map() and s_vcardparameter_compare_kind_map() in both the iCalendar and vCard generated parameter files; because the change is annotated as a 4.0 binary-compatibility shim to be removed in 4.1, downstream vendors should either backport that commit into their 4.0.6 build or track the first libical 4.1 release that ships it, and should verify against https://github.com/libical/libical/issues/1361 for maintainer guidance. Until a patched package is confirmed, compensating controls are build- and architecture-level rather than input-level: (1) if the product is compiled with clang CFI or -fsanitize=function, note that this is precisely the configuration that converts the type confusion into a deterministic abort - disabling those sanitizers/CFI for the calendar-parsing component restores the pre-fix non-trapping behavior but removes a general hardening layer and should be treated as a temporary, scoped trade-off; (2) run parsing of untrusted .ics/.vcf content in a separate, resource-limited process or sandbox (seccomp/container with restart-on-exit supervision) so that an abort degrades nothing beyond that worker - this adds operational complexity and startup overhead but is the most reliable mitigation regardless of build flags; (3) restrict ingestion of external calendar/vCard data to trusted sources or gate it behind explicit processing queues so that the bsearch() path is not reached with untrusted parameterized properties, accepting reduced functionality for untrusted-feed use cases. No vendor patch version number is asserted here because only the upstream PR/commit is confirmed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libical is a widely embedded C library for parsing and generating iCalendar (RFC 5545) and vCard data, used by calendar servers, mail clients, and groupware stacks. CVE-2026-88383 is a CWE-843 incompatible-type confusion at the function-pointer level: icalparameter_string_to_kind() (and its sibling vcardparameter_string_to_kind() in libicalvcard) hands the comparator icalparameter_compare_kind_map() to bsearch() after casting it to int (*)(const void *, const void *), even though the underlying function is declared with concrete struct icalparameter_kind_map * parameters. Before the fix, the generated files src/libical/icalderivedparameter.c.in and src/libicalvcard/vcardderivedparameter.c.in cast away the signature mismatch, so the C standard's undefined behavior is provoked whenever a parameterized property causes the binary search to invoke the callback through the wrong type. The upstream patch introduces static wrapper functions s_icalparameter_compare_kind_map() and s_vcardparameter_compare_kind_map() with correctly typed const void * signatures that internally cast to the concrete struct, eliminating the mismatch; the original symbols are retained for binary compatibility in the 4.0 series and marked for removal in 4.1. In hardened builds - CFI (e.g., clang CFI or -fsanitize=function) - the indirect call is rejected and the process aborts, producing the observed denial of service; on non-hardened builds the mismatched call typically completes without a trap, which is why the impact is build-configuration dependent and why the authoritative assessment raises attack complexity to AC:H relative to the raw AV:L/6.2 score.
Know when Libical gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
iCalendar data is typically remotely delivered (AV:N), but reliable crashing depends on a CFI/UBSan-hardened build so AC:H; no auth needed (PR:N) and only availability is affected.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafte
The icaltime_from_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-b
The parser_get_next_char function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-b
Decoding crafted iCalendar text that ends in a trailing backslash drives a heap-based out-of-bounds read in libical 4.0.
The icalparser_parse_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-o
The icalproperty_new_clone function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (use-af
libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file. Rated medium s
Exploit-DB