SB2026102302 - Fedora 43 update for libical

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102302

SB2026102302 - Fedora 43 update for libical

Published: October 23, 2026

Security Bulletin ID SB2026102302
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Out-of-bounds read (CVE-ID: CVE-2026-111269)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service or disclose limited contents of adjacent memory.

The vulnerability exists due to an out-of-bounds read in icalvalue_decode_ical_string() when decoding input ending in a backslash. A remote attacker can trick a user into processing specially crafted text through an application that calls this function to cause it to read beyond the terminating NUL, potentially crashing the application or copying adjacent memory into the returned string.

The affected function is a public API also exposed by libical-glib as i_cal_value_decode_ical_string(); libical's own parser does not call it.


Remediation

Install update from vendor's website.

References