Firebird CVE-2026-28214

Exploitation requires the following concrete conditions: (1) Network or local access to a Firebird database server accepting connections; (2) Valid authentication credentials (username and password) for the database; (3) INSERT privilege on at least one table within the target database - this is the critical gateway; (4) Ability to craft and transmit a malformed Batch Parameter Block (achievable through direct wire protocol manipulation, custom client applications, or SQL if the application layer exposes parameterization). The attack is not possible against default Firebird installations if strict access controls restrict INSERT to system accounts or specific trusted roles. Default configurations with broad user account creation or permissive INSERT grants increase risk. Single-user/embedded Firebird instances are affected if accessed via local authentication with INSERT privilege.

The CVSS 4.0 vector indicates network-accessible attack surface (AV:N) with low complexity (AC:L), but importantly requires low privileges (PR:L) and prior attack timing (AT:P). Exploitation is limited to authenticated users already possessing INSERT privileges on at least one table - a significant privilege requirement that excludes unauthenticated attackers and many low-privilege accounts. The impact is availability-focused (VA:H) with no confidentiality or integrity breach. Attack timing (AT:P) suggests exploitation requires precise conditions or coordination, further reducing real-world risk. CVSS score of 6.0 reflects moderate severity but masks the privilege barrier. The integer overflow root cause is genuine and reliably triggerable once access is obtained, but the authenticated + INSERT privilege prerequisite substantially lowers practical exploitation probability compared to unauthenticated network vulnerabilities. Organizations with strict database access controls and least-privilege application accounts will see minimal risk; those allowing broad INSERT access across databases face higher exposure.

A database administrator or application user with INSERT privilege on any table crafts a malicious Batch Parameter Block containing a Wide type clumplet with an overflow-triggering totalLength value and submits it to a Firebird server (via SQL INSERT, application API call, or direct wire protocol). The server's ClumpletReader function enters an infinite loop while parsing the clumplet, consuming CPU resources and preventing legitimate queries from executing. The attacker can repeatedly send such requests to amplify the denial of service effect across multiple server threads.