Firebird EUVD-2026-23482

No special conditions - remote unauthenticated exploitation against default configurations of Firebird servers. The vulnerability exists in the XDR slice packet deserialization path which processes incoming network traffic before authentication enforcement in affected code paths. Exploitation requires only network reachability to Firebird's listening port (default 3050/tcp). Attack complexity is low (AC:L) with no required user interaction (UI:N). The vulnerability is triggered by any client connection sending a malformed slice packet, regardless of whether the connection proceeds to successful authentication. Limiting factors: requires the Firebird port to be network-accessible to the attacker; firewall rules restricting access to trusted networks significantly reduce exposure but do not eliminate risk from insider threats or compromised trusted systems.

Real-world risk is HIGH for internet-exposed Firebird installations. CVSS 7.5 with AV:N/AC:L/PR:N indicates trivial remote exploitation against default configurations requiring no authentication or user interaction. The S:U (Unchanged scope) and C:N/I:N/A:H vector indicates denial-of-service is the primary confirmed impact, though memory corruption vulnerabilities often escalate to code execution upon further research. EPSS score unavailable limits probabilistic assessment, but the combination of network reachability, no authentication barrier, and publicly documented fix versions in GitHub releases significantly elevates exploitation likelihood. No CISA KEV listing suggests targeted rather than widespread exploitation to date, though the window between disclosure and patching represents peak risk. Public vendor advisory (GHSA-89mq-229g-x47p) with technical details enables proof-of-concept development. Organizations running Firebird on public networks or in multi-tenant environments face immediate risk; those with internal-only deployments behind authentication layers have reduced but non-zero exposure since the vulnerability may be reachable in some pre-auth protocol paths. The availability of patches across all three supported major versions (3.x, 4.x, 5.x) indicates vendor treats this as critical - three simultaneous security releases is uncommon for Firebird.

An external attacker scans for Firebird databases exposed on port 3050/tcp. Upon discovering an unpatched server, they craft a malicious slice packet with an oversized cstring length field that exceeds the allocated buffer size declared in the slice descriptor. Sending this packet to the server triggers the buffer overflow in xdr_datum() during deserialization, corrupting heap memory and causing the Firebird process to crash. The attacker repeats this against production databases during business hours, causing sustained denial-of-service and data unavailability. In advanced scenarios, heap memory layout manipulation could potentially achieve code execution, though the primary documented impact is availability loss.