libical CVE debriefs

CVE-2026-111269

libical through 4.0.6 is vulnerable to a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c. This occurs when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator, potentially crashing the application or leaking adjacent heap memory. Defenders should assess exposure [truncated]