CVE-2026-111269
libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding in
CVSS
6.1
Medio
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 15 oct 2026 · Última mod.: 15 oct 2026 · CWE-125
Sin historial EPSS suficiente todavía.
libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.
- github.comhttps://github.com/libical/libical
- github.comhttps://github.com/libical/libical/blob/9cfca65c122fa23b9680a28e0c9225a2fd015fc5/src/libical/icalvalue.c#L1608-L1645
- github.comhttps://github.com/libical/libical/commit/d753885ce2de7c105d6b8c405aa7aee1d98ad8de
- github.comhttps://github.com/libical/libical/pull/1455
- hackmd.iohttps://hackmd.io/@haind-pwn/libical-icalvalue-decode-ical-string-oob-read
- www.vulncheck.comhttps://www.vulncheck.com/advisories/libical-through-4.0.6-heap-out-of-bounds-read-via-icalvalue-decode-ical-string
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1112745.5 MED—
———unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash the process.7hCVE-2026-1112725.5 MED—
———LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image.7hCVE-2026-1112715.5 MED—
———libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer.7hCVE-2024-583976.1 MED—
———MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications like mp4chaps or leaking adjacent heap memory into chapter titles.8hCVE-2026-1084556.5 MED—
———Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.7hCVE-2026-1084536.5 MED—
———Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.7h