Firebird EUVD-2026-23496

Authenticated database access with CREATE FUNCTION privilege is required. The attacker must possess valid Firebird credentials (username/password or trusted authentication) and either hold a role that includes CREATE FUNCTION permission or compromise an account with this privilege, which is typically restricted to database administrators and application service accounts in production environments. Additionally, the attacker needs a method to place a malicious shared library file on the server's filesystem at a predictable path accessible to the Firebird server process, achieved through separate file upload vulnerabilities, write access to shared directories like /tmp, or pre-existing web shells. The vulnerability affects default Firebird configurations where external engine plugin functionality is enabled. Network access to the Firebird service port (default 3050/tcp) is required for remote exploitation, though local authenticated users can exploit without network exposure. No user interaction beyond the attacker's authenticated session is needed.

Real-world risk is HIGH for exposed Firebird installations despite requiring authentication (PR:L). The CVSS 10.0 score accurately reflects severity: network-accessible (AV:N), low complexity (AC:L), scope change enabling full system compromise (S:C), and immediate code execution without user interaction (UI:N). However, exploitation is gated by two meaningful prerequisites: the attacker must possess valid database credentials AND have CREATE FUNCTION privileges, which are typically restricted to DBAs or application service accounts in properly configured deployments. No CISA KEV listing suggests exploitation has not reached mass-scanning campaigns, but the simplicity of the attack (AC:L) and availability of proof-of-concept code via the GitHub security advisory make weaponization trivial for targeted attacks. Organizations exposing Firebird to untrusted networks or sharing credentials broadly face immediate risk. The three-year version spread (3.0.x, 4.0.x, 5.0.x affected) indicates large vulnerable install base. SSVC assessment: exploitation status unclear from available data, technical impact total (code execution as server process), automatable once credentials obtained. Priority should be IMMEDIATE for internet-facing instances, HIGH for internal deployments with untrusted authenticated users.

An attacker with valid credentials to a Firebird database server obtains CREATE FUNCTION privileges through either legitimate role assignment or by compromising an application service account. The attacker crafts a SQL statement like CREATE FUNCTION malicious RETURNS INTEGER BY VALUE ENTRY_POINT 'func' ENGINE '../../../tmp/malware' where the ENGINE clause contains path traversal sequences pointing to a malicious shared library they previously uploaded to a world-writable directory (/tmp, /var/tmp) or a web-accessible path. Upon execution, Firebird's plugin loader resolves the traversal to load /tmp/malware.so, immediately executing its initialization code as the firebird server user before any validation occurs, granting shell access and persistence on the database host.