Out-of-bounds read in libical - CVE-2026-111269
Published: October 22, 2026
Vulnerability identifier: #VU157260
CSH Severity: Medium
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-111269
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service or disclose limited contents of adjacent memory.
The vulnerability exists due to an out-of-bounds read in icalvalue_decode_ical_string() when decoding input ending in a backslash. A remote attacker can trick a user into processing specially crafted text through an application that calls this function to cause it to read beyond the terminating NUL, potentially crashing the application or copying adjacent memory into the returned string.
The affected function is a public API also exposed by libical-glib as i_cal_value_decode_ical_string(); libical's own parser does not call it.
Affected software
libical
Fedora
libical
Fedora
libical
How to mitigate CVE-2026-111269
Install security update from vendor's website.
libical - update to 4.0.7
libical - addressed in versions 3.0.20-6.fc43, 3.0.20-9.fc44
libical - addressed in versions 3.0.20-6.fc43, 3.0.20-9.fc44