Firebird CVE-2026-34232

No special conditions required for exploitation-remote unauthenticated attackers can target default Firebird Database Server configurations accessible over TCP/IP. The vulnerability is triggered during op_response packet processing in the network protocol layer, which occurs before any authentication or session establishment. Attack succeeds against any Firebird instance listening on network sockets (client-server mode) running vulnerable versions (pre-5.0.4, pre-4.0.7, or pre-3.0.14). Embedded Firebird deployments without network listeners are NOT vulnerable as the attack vector requires network packet delivery. Attack complexity is low (AC:L in CVSS vector) with no prerequisites for special server configurations, enabled features, or timing dependencies-any network reachability to port 3050 is sufficient.

This vulnerability presents CONFIRMED HIGH risk for availability disruption with LOW operational barriers to exploitation. The CVSS 7.5 score accurately reflects severity: network attack vector (AV:N) enables remote exploitation, low complexity (AC:L) requires no specialized conditions, no privileges (PR:N) or user interaction (UI:N) needed, and high availability impact (A:H) causes complete service denial. However, scope unchanged (S:U) and no confidentiality/integrity impact (C:N/I:N) limit this to pure DoS-no data exfiltration or system compromise possible. No EPSS score provided, but the technical simplicity (crafting malformed XDR packets) and lack of authentication barriers suggest moderate exploitation probability if databases are internet-exposed. No CISA KEV listing indicates no confirmed widespread exploitation as of analysis date. GitHub advisory (GHSA-7jq3-6j3c-5cm2) confirms the technical details and vendor acknowledgment. Real-world risk depends heavily on deployment: databases behind application tiers or firewalls limiting direct network access face minimal risk, while internet-facing Firebird instances (common in legacy deployments or misconfigured cloud environments) are critically vulnerable to trivial DoS attacks. The availability-only impact means this is lower priority than RCE/data breach vulnerabilities, but for mission-critical database services, repeated crashes can constitute significant operational disruption.

An external attacker scans for internet-exposed Firebird databases on TCP port 3050, identifying vulnerable instances via banner grabbing or service fingerprinting. The attacker crafts a malicious op_response packet containing an isc_arg_cstring type in the status vector payload-easily achievable using standard XDR encoding libraries or modified Firebird client code. Upon sending this packet to the server's network listener, the xdr_status_vector() function attempts to decode the malformed structure, encounters the unhandled type, and crashes the database server process, causing immediate denial of service for all connected clients and halting transaction processing until manual restart.