CVE-2026-88383

Name	CVE-2026-88383
Description	libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1149060

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libical3 (PTS)	bookworm	3.0.16-1	vulnerable
	trixie	3.0.20-1	vulnerable
	forky, sid	3.0.20-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libical	source	(unstable)	(unfixed)
libical3	source	(unstable)	(unfixed)	unimportant		1149060

Notes

https://github.com/libical/libical/issues/1361
https://github.com/libical/libical/pull/1363
Fixed by: https://github.com/libical/libical/commit/1fc946aaa91e5995dee593092723ba67d7113846 (4.0 branch)
Negligible security impact