Firebird CVE-2026-35215

Firebird database server configured to accept network connections on TCP port 3050 (default) or alternate configured port. No authentication, user interaction, or special database features required - the vulnerable sdl_desc() function processes slice packets during normal protocol handling before authentication occurs. Exploitation succeeds against default Firebird installations listening on network interfaces. Limiting factor: firewall rules blocking external access to database ports prevent remote exploitation, restricting attack surface to local network adversaries or compromised hosts within the trusted network perimeter.

Real-world risk is HIGH for internet-exposed Firebird instances. CVSS vector AV:N/AC:L/PR:N/UI:N indicates the worst-case exploitability: network-accessible, low complexity, no authentication, no user interaction required. While impact is limited to availability (A:H, C:N, I:N), database downtime is mission-critical for most deployments. SSVC technical impact is PARTIAL (denial of service only, no data compromise), but automatability is YES given the straightforward protocol manipulation required. The GitHub security advisory provides sufficient technical detail for skilled attackers to craft exploit packets without needing source code access. Absence of EPSS score and KEV listing suggests no widespread exploitation detected yet, but the low barrier to exploitation and common internet exposure of database ports (default TCP 3050) make this a time-sensitive patching priority. Organizations running Firebird 3.x/4.x/5.x on network-accessible ports face immediate risk of service disruption from opportunistic or targeted attackers.

An attacker identifies a Firebird database server exposed on the internet (port scan reveals TCP 3050 open). Without authenticating, the attacker crafts a malicious Firebird protocol slice packet containing a zero-length SDL descriptor and sends it to the server. The sdl_desc() function processes the packet, attempts to divide by the zero-length value when calculating slice items, triggers a division-by-zero exception, and crashes the database process. Legitimate users lose database access until administrators restart the service, enabling repeated denial-of-service attacks.