EUVD-2026-102524

libical through 4.0.6 contains a heap-based out-of-bounds read in icalvaluedecodeicalstring in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the...

CVE-2026-111269

A flaw was found in libical. When decoding calendar input ending with a trailing backslash, the library can read beyond allocated memory boundaries in the icalvaluedecodeicalstring function. An attacker could supply specially crafted iCalendar data to cause an application crash, leading to a Deni...

CVE-2026-111269

Versions of libical through 4.0.6 are vulnerable to a heap-based out-of-bounds read in the icalvalue_decode_ical_string() function located in src/libical/icalvalue.c. This flaw occurs when the software decodes input ending in a backslash, specifically when handling escaped iCalendar text; the pro...