Bug 2540578 (CVE-2026-88383) - CVE-2026-88383 libical: libical: Denial of Service via crafted iCalendar property parsing
Summary: CVE-2026-88383 libical: libical: Denial of Service via crafted iCalendar prop...
Keywords:
Status: NEW
Alias: CVE-2026-88383
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2540947
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-24 17:25 UTC by OSIDB Bzimport
Modified: 2026-09-25 06:20 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github libical libical issues 1361 0 None closed [Bug]icalparameter_string_to_kind() invokes bsearch comparator through an incompatible function pointer, triggering unde... 2026-09-25 06:17:42 UTC

Description OSIDB Bzimport 2026-09-24 17:25:30 UTC
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.

Comment 1 Milan Crha 2026-09-25 06:17:43 UTC
The fix [1] is not released yet. Nonetheless Fedora is still in the 3.x series, not 4.x series (it's awaiting approval), thus, as it is in the time of writing this comment, the Fedora is unaffected by it.

[1] https://github.com/libical/libical/issues/1361

Comment 2 Milan Crha 2026-09-25 06:20:11 UTC
(In reply to Milan Crha from comment #1)
> Nonetheless Fedora is still in the 3.x series, not 4.x series (it's awaiting approval),
> thus, as it is in the time of writing this comment, the Fedora is unaffected by it.

Ehm, or not, I just checked and the 3.x series has the same code.


Note You need to log in before you can comment on or make changes to this bug.