DEBIAN-CVE-2026-88383

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-88383
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-88383.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-88383
Upstream
  • CVE-2026-88383
Published
2026-09-24T17:17:07Z
Modified
2026-10-07T10:00:13Z
Severity
  • 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.

References

Affected packages

Debian:12 / libical3

Package

Name
libical3
Purl
pkg:deb/debian/libical3?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.0.16-1
3.0.17-1
3.0.17-1.1~exp1
3.0.17-1.1
3.0.18-1
3.0.19-1
3.0.19-2
3.0.19-3
3.0.19-4
3.0.20-1
3.0.20-2
3.0.20-3

Ecosystem specific 

{
    "urgency":  "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-88383.json"

Debian:13 / libical3

Package

Name
libical3
Purl
pkg:deb/debian/libical3?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.0.20-1
3.0.20-2
3.0.20-3

Ecosystem specific 

{
    "urgency":  "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-88383.json"

Debian:14 / libical3

Package

Name
libical3
Purl
pkg:deb/debian/libical3?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.0.20-1
3.0.20-2
3.0.20-3

Ecosystem specific 

{
    "urgency":  "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-88383.json"