A heap-based out-of-bounds read vulnerability exists in libical through version 4.0.6 in the function icalvalue_decode_ical_string() when decoding input that ends with a backslash. This flaw can cause the application to crash or leak adjacent heap memory when processing specially crafted escaped iCalendar text with a trailing backslash. The issue is fixed in version 3.0.17-4.oe2403sp4.