CVE-2016-5827: The icaltime_from_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of serv...

Security readout for executives and security teams

CVE-2016-5827 is a denial-of-service issue in libical 0.47 and 1.0. A specially crafted calendar string can trigger an out-of-bounds heap read during parsing, potentially crashing software that uses the library. There is no source-provided evidence of active exploitation or data theft impact. Exposure is most likely where applications use libical 0.47 or 1.0 to parse untrusted iCalendar or calendar-related input. The provided sources do not identify specific downstream products or distributions. Treat as a targeted availability risk, not a confirmed breach indicator. Prioritize if calendar parsing is exposed to external users or supports business-critical scheduling workflows. Otherwise handle through normal vulnerability management. Mitigation focus: Inventory systems and applications using libical 0.47 or 1.0.; Check operating system, application, and libical vendor guidance for fixed packages.; Reduce parsing of untrusted calendar input where operationally feasible..

Prepared

Jun 13, 2026, 12:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.