EUVD-2026-23466Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
7DescriptionGitHub Advisory
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when parsing a Wide type clumplet, causing an infinite loop. An authenticated user with INSERT privileges on any table can exploit this via a crafted Batch Parameter Block to cause a denial of service against the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
AnalysisAI
Integer overflow in Firebird database versions prior to 5.0.4, 4.0.7, and 3.0.14 allows authenticated users with INSERT privileges to trigger a denial of service via a malformed Batch Parameter Block that overflows the totalLength value in ClumpletReader::getClumpletSize(), causing infinite loop conditions on the server.
Technical ContextAI
Firebird's ClumpletReader::getClumpletSize() function processes Wide type clumplets within Batch Parameter Blocks (BPBs) - structures used to pass parameters to database operations. The vulnerability stems from an integer overflow (CWE-190) in the totalLength accumulation logic when parsing clumplet size fields. When a Wide type clumplet is crafted with specific values, the totalLength integer wraps around, causing the parsing loop to never reach its termination condition and instead iterate infinitely. This affects the core parameter parsing mechanism used during authenticated database session setup and command execution. The CPE indicates all versions of Firebird are potentially affected until the stated patch versions are applied.
RemediationAI
Upgrade to Firebird 5.0.4, 4.0.7, or 3.0.14 (or later patches within your major version) immediately. The vendor has released patched versions for all supported branches. Interim compensating controls include restricting INSERT privileges to only trusted application accounts and specific tables via role-based access control (REVOKE INSERT from untrusted roles), disabling user database creation if not required (reduces attack surface for privilege escalation paths), and implementing connection-level rate limiting or query timeout policies at the firewall or proxy layer to mitigate infinite loop impact. However, these controls do not eliminate the vulnerability - patching is the only definitive fix. Organizations unable to patch immediately should audit database user accounts with INSERT privileges and revoke them from accounts not requiring them.
Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514, and 2.5.1 through 2.5.3 before 26623, on Windo
Firebird is a relational database. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. Public ex
FireBird 2.5.5 allows remote authenticated users to cause a denial of service (daemon crash) by using service manager to
Remote code execution in Firebird RDBMS versions prior to 5.0.4, 4.0.7, and 3.0.14 allows authenticated users with CREAT
Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticate
The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a de
Null pointer dereference in Firebird SQL server causes remote denial-of-service when unauthenticated attackers send malf
Remote denial-of-service in Firebird database server versions prior to 5.0.4, 4.0.7, and 3.0.14 allows unauthenticated n
Information disclosure in Firebird 3.x client library when connecting to Firebird 4+ servers allows local authenticated
Firebird database server crashes via crafted slice packet exploiting zero-length SDL descriptor validation flaw. Remote
Remote denial-of-service in Firebird Database Server versions prior to 5.0.4, 4.0.7, and 3.0.14 allows unauthenticated n
Buffer overflow in Firebird RDBMS allows remote unauthenticated attackers to crash database servers via malformed slice
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today