Bug 2540578 (CVE-2026-88383)

Summary:	CVE-2026-88383 libical: libical: Denial of Service via crafted iCalendar property parsing
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mcrha, rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in libical. When parsing calendar data containing parameterized properties, the library improperly invokes an internal search callback due to a function pointer mismatch. An attacker could exploit this vulnerability by providing specially crafted iCalendar data to an application using libical, causing the process to crash and resulting in a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2540947
Bug Blocks:

Description OSIDB Bzimport 2026-09-24 17:25:30 UTC

libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.

Comment 1 Milan Crha 2026-09-25 06:17:43 UTC

The fix [1] is not released yet. Nonetheless Fedora is still in the 3.x series, not 4.x series (it's awaiting approval), thus, as it is in the time of writing this comment, the Fedora is unaffected by it.

[1] https://github.com/libical/libical/issues/1361

Comment 2 Milan Crha 2026-09-25 06:20:11 UTC

(In reply to Milan Crha from comment #1)
> Nonetheless Fedora is still in the 3.x series, not 4.x series (it's awaiting approval),
> thus, as it is in the time of writing this comment, the Fedora is unaffected by it.

Ehm, or not, I just checked and the 3.x series has the same code.