CVE-2026-88383

Awaiting Analysis Awaiting Analysis - Queue

libical 4.0.6 Function Pointer Mismatch in bsearch()

Publication date: 2026-09-24

Last updated on: 2026-10-06

Assigner: MITRE

Description

libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-06

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-88383

EUVD

EUVD-2026-86316

Affected Vendors & Products

Vendor	Product	Version / Range
libical	libical	4.0.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

Executive Summary

This vulnerability in libical 4.0.6 occurs when parsing iCalendar data with parameterized properties. The function icalparameter_string_to_kind() incorrectly passes a mismatched function pointer to bsearch(), causing undefined behavior. The comparator function icalparameter_compare_kind_map() has incompatible parameter types for bsearch(), leading to potential crashes or denial of service.

Detection Guidance

To detect this vulnerability, compile libical 4.0.6 with the -fsanitize=function flag and enable Undefined Behavior Sanitizer (UBSan). Run the application processing iCalendar data and check for SIGILL errors during parsing of parameterized properties like ATTACH;FILENAME=test.bin:. The issue triggers undefined behavior in bsearch() due to a mismatched function pointer type.

Impact Analysis

If you use libical 4.0.6 to parse iCalendar data containing properties with parameters (like ATTACH;FILENAME=test.bin:), the application may crash or terminate unexpectedly. This could disrupt services relying on libical for calendar data processing, especially in applications handling user-provided iCalendar inputs.

Compliance Impact

This vulnerability causes undefined behavior and potential process termination when parsing iCalendar data, which could lead to denial of service. Such disruptions may impact compliance with standards requiring availability, such as GDPR's requirement for timely data processing or HIPAA's need for continuous access to protected health information.

Mitigation Strategies

Immediately upgrade libical to a patched version or apply the fix from PR #1363. Replace direct use of icalparameter_compare_kind_map with wrapper functions to ensure binary compatibility with bsearch(). Alternatively, avoid parsing iCalendar data containing parameterized properties until patched.

Hi! I’m here to help you understand CVE-2026-88383. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70