This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-88383 →

UBUNTU-CVE-2026-88383

libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized prop...

Original description

The description as published by the source.

libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:16.04:LTS libical

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:18.04:LTS libical

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

report ubuntu.com
report cve.org