# CVE-2016-5823: libical use-after-free in icalproperty_new_clone

Source: https://junglewise.ai/threats/cve-2016-5823-libical-use-after-free-in-icalproperty-new-clone  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-27. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-5823 · Severity: medium · CVSS 5.5 · Published 2017-01-27

libical is a widely used software library for handling calendar data (iCalendar). A vulnerability in how it processes calendar files could allow an attacker to crash applications that use this library, such as email clients or scheduling software, by sending a specially crafted calendar (.ics) file. This results in a denial of service, potentially disrupting user schedules and communication tools.

Technologies: [Libical Project Libical](https://junglewise.ai/threats/technologies/libical). Vendors: [Libical Project](https://junglewise.ai/threats/vendors/libical-project).

## Quick answers

**Is CVE-2016-5823 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-5823 being exploited in the wild.

**How severe is CVE-2016-5823?** Medium severity, with a CVSS score of 5.5, published 27 January 2017.

**Which products and versions are affected?** Libical Project Libical 0.47, 1.0, and all versions prior to 3.0.0.

**Is there a fix for CVE-2016-5823?** A patch was published on 2019-04-02: Gentoo security advisory indicates version 3.0.0 as unaffected Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-5823 attacked?** It is attacked with local access or over the network, in a software library.

**Am I affected by CVE-2016-5823?** Check whether you run Libical Project Libical at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in the icalproperty_new_clone function within libical versions 0.47, 1.0, and potentially others prior to 3.0.0. The flaw is triggered when the library processes a malformed iCalendar (.ics) file, leading to a segmentation fault (SEGV) or memory corruption. While the NVD classifies the attack vector as local with user interaction (opening a file), the practical application in mail clients or servers often makes this reachable via remote delivery of malicious attachments. An attacker can exploit this to cause a denial of service (application crash). The issue was addressed in libical version 3.0.0.

## Affected products

- libical project libical 0.47, 1.0, and all versions prior to 3.0.0

## Timeline

- 2016-06-25: disclosed: Public disclosure on oss-security mailing list
- 2017-01-27: advisory: NVD publication date
- 2019-04-02: patched: Gentoo security advisory indicates version 3.0.0 as unaffected

## References

- [http://www.openwall.com/lists/oss-security/2016/06/25/4](http://www.openwall.com/lists/oss-security/2016/06/25/4)
- [https://security.gentoo.org/glsa/201904-02](https://security.gentoo.org/glsa/201904-02)

## Related threats

- [libical out-of-bounds read in icaltime_from_string](https://junglewise.ai/threats/cve-2016-5827-libical-out-of-bounds-read-in-icaltime-from-string)
- [libical out-of-bounds read in parser_get_next_char](https://junglewise.ai/threats/cve-2016-5826-libical-out-of-bounds-read-in-parser-get-next-char)
- [libical out-of-bounds read in icalparser_parse_string](https://junglewise.ai/threats/cve-2016-5825-libical-out-of-bounds-read-in-icalparser-parse-string)
- [libical use-after-free in iCalendar parsing](https://junglewise.ai/threats/cve-2016-5824-libical-use-after-free-in-icalendar-parsing)
- [libical use-after-free in iCalendar parser](https://junglewise.ai/threats/cve-2016-9584-libical-use-after-free-in-icalendar-parser)