CVE-2026-111269

Received Received - Intake

Heap-based Out-of-Bounds Read in libical

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111269

Affected Vendors & Products

Vendor	Product	Version / Range
libical	libical	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

libical through version 4.0.6 has a heap-based out-of-bounds read vulnerability in the function icalvalue_decode_ical_string(). The issue occurs when processing iCalendar text ending with a backslash. The loop fails to stop at the terminator, causing it to read beyond allocated memory. This can crash the application or expose adjacent heap memory.

Impact Analysis

An attacker could exploit this flaw by providing malicious iCalendar data with a trailing backslash. This may lead to application crashes or unauthorized memory access. If successful, it could allow information disclosure or denial-of-service conditions on systems using vulnerable libical versions.

Compliance Impact

This vulnerability may impact compliance by enabling data breaches through memory exposure or service disruption via crashes. GDPR requires protecting personal data integrity and availability, while HIPAA mandates safeguarding health information. Exploitation could violate these requirements, potentially leading to regulatory penalties or loss of trust.

Mitigation Strategies

Update libical to version 4.0.7 or later to address the heap-based out-of-bounds read vulnerability in icalvalue_decode_ical_string().

Hi! I’m here to help you understand CVE-2026-111269. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70