CVE-2026-111269

A flaw was found in libical. When decoding calendar input ending with a trailing backslash, the library can read beyond allocated memory boundaries in the icalvalue_decode_ical_string() function. An attacker could supply specially crafted iCalendar data to cause an application crash, leading to a Denial of Service (DoS), or potentially expose adjacent memory contents.

This vulnerability is rated as Moderate severity because exploitation requires an application using libical to process an untrusted iCalendar payload, resulting primarily in an application crash or limited heap memory read without enabling arbitrary code execution. Across standard Red Hat Enterprise Linux environments, libical is deployed as a shared library for calendar management rather than an externally exposed network service. Because processing typically occurs within client applications or local background services upon user interaction, the impact is confined to a denial of service of the affected process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.