MEDIUM 6.2 Microsoft
CVE-2026-88383
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
Microsoft Security Update 2026-Sep: libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
Affected Products
- azl3 libical 3.0.10-1 on Azure Linux 3.0
- azl3 libical 3.0.10-3 on Azure Linux 3.0
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88383
- https://nvd.nist.gov/vuln/detail/CVE-2026-88383
This medium severity vulnerability with a CVSS score of 6.2 was published on 2026-09-08 via Microsoft. Affected: azl3 libical 3.0.10-1 on Azure Linux 3.0, azl3 libical 3.0.10-3 on Azure Linux 3.0.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.