Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111269— libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string

Quick assessment

Affected
libical libical
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

libical 4.0.6 及更早版本中存在一个基于堆的越界读取漏洞，该漏洞出现在 文件中的 函数中，在解码以反斜杠结尾的输入时会触发此问题。攻击者可以构造包含末尾反斜杠的转义 iCalendar 文本作为输入，导致循环在终止符之后读取内存，从而可能引起应用程序崩溃或泄露相邻的堆内存数据。

CVSS 6.1 · Medium

Possible ATT&CK Techniques 1 AI

T1210 · Exploitation of Remote Services
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111269

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string
Source: CVE Program / CVE List V5
Vulnerability Description
libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
libical libical 0 ~ 4.0.6 -

II. Public POCs for CVE-2026-111269

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111269

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-111269 (2)

Vendor Advisories for CVE-2026-111269 (1)

Proof of Concept for CVE-2026-111269 (1)

Vendor Pages for CVE-2026-111269 (1)

IV. Related Vulnerabilities

Same weakness: CWE-125

V. Comments for CVE-2026-111269

No comments yet

Leave a comment