CVE catalog

CVE-2026-88383

Severity: Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published: Sep 24, 2026, 12:00:00 AM UTC
Updated: Sep 24, 2026, 5:17:07 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.20% · Oct 25, 2026

libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libical3	sid	`3.0.20-3`	vulnerable
Debian	libical3	forky	`3.0.20-3`	vulnerable
Debian	libical3	trixie	`3.0.20-1`	vulnerable
Debian	libical3	bookworm	`3.0.16-1`	vulnerable
Ubuntu	libical	16.04	`1.0.1-0ubuntu1`	vulnerable
Ubuntu	libical	16.04	`1.0.1-0ubuntu2`	vulnerable
Ubuntu	libical	18.04	`2.0.0-0.5`	vulnerable
Ubuntu	libical	18.04	`2.0.0-0.5build1`	vulnerable
Ubuntu	libical	18.04	`2.0.0-1ubuntu1`	vulnerable
Ubuntu	libical	18.04	`2.0.0-4`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libical3	source	sid	`(unfixed)`	unimportant	Not reported	[1149060]
Debian	libical3	source	forky	`(unfixed)`	unimportant	Not reported	[1149060]
Debian	libical3	source	trixie	`(unfixed)`	unimportant	Not reported	[1149060]
Debian	libical3	source	bookworm	`(unfixed)`	unimportant	Not reported	[1149060]

[Debian bug #1149060]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gir1.2-ical-3.0]Affected
Source package: [libical3]
Details (2)
- 3.0.16-1+b1 · amd64 · bookworm
  Affected
  nvd · libical3 · debian · bookworm; nvd · libical3 · debian · 12
- 3.0.16-1+b1 · arm64 · bookworm
  Affected
  nvd · libical3 · debian · bookworm; nvd · libical3 · debian · 12
[libical3]Affected
Source package: [libical3]
Details (2)
- 3.0.16-1+b1 · amd64 · bookworm
  Affected
  nvd · libical3 · debian · bookworm; nvd · libical3 · debian · 12
- 3.0.16-1+b1 · arm64 · bookworm
  Affected
  nvd · libical3 · debian · bookworm; nvd · libical3 · debian · 12
[libical-dev]Affected
Source package: [libical3]
Details (2)
- 3.0.16-1+b1 · amd64 · bookworm
  Affected
  nvd · libical3 · debian · bookworm; nvd · libical3 · debian · 12
- 3.0.16-1+b1 · arm64 · bookworm
  Affected
  nvd · libical3 · debian · bookworm; nvd · libical3 · debian · 12
[libical-doc]Affected
Source package: [libical3]
Details (2)
- 3.0.16-1 · all · bookworm
  Affected
  nvd · libical3 · debian · bookworm; nvd · libical3 · debian · 12
- 3.0.16-1 · all · bookworm
  Affected
  nvd · libical3 · debian · bookworm; nvd · libical3 · debian · 12

[Debian 13 (Trixie)]

[gir1.2-ical-3.0]Affected
Source package: [libical3]
Details (2)
- 3.0.20-1+b1 · amd64 · trixie
  Affected
  nvd · libical3 · debian · 13
- 3.0.20-1+b1 · arm64 · trixie
  Affected
  nvd · libical3 · debian · 13
[libical3t64]Affected
Source package: [libical3]
Details (2)
- 3.0.20-1+b1 · amd64 · trixie
  Affected
  nvd · libical3 · debian · 13
- 3.0.20-1+b1 · arm64 · trixie
  Affected
  nvd · libical3 · debian · 13
[libical-dev]Affected
Source package: [libical3]
Details (2)
- 3.0.20-1+b1 · amd64 · trixie
  Affected
  nvd · libical3 · debian · 13
- 3.0.20-1+b1 · arm64 · trixie
  Affected
  nvd · libical3 · debian · 13
[libical-doc]Affected
Source package: [libical3]
Details (2)
- 3.0.20-1 · all · trixie
  Affected
  nvd · libical3 · debian · 13
- 3.0.20-1 · all · trixie
  Affected
  nvd · libical3 · debian · 13

Observed: Oct 23, 2026, 8:26:16 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]