PT-2026-33476 · Firebird+1 · Firebird+1

Published 2026-04-17 · Updated 2026-05-15 · CVE-2026-27890

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions Firebird versions prior to 5.0.4 Firebird versions prior to 4.0.7 Firebird versions prior to 3.0.14

Description An issue exists during authentication when processing CNCT specific data segments. The server assumes these segments arrive in strictly ascending order; however, if they arrive out of order, the grow() method of the Array class computes a negative size value, leading to a SIGSEGV crash (a segmentation fault where the program attempts to access a memory location that it is not allowed to access). An unauthenticated attacker with knowledge of the server IP and port can trigger this crash.

Recommendations Update to version 5.0.4 Update to version 4.0.7 Update to version 3.0.14

Fix

DoS

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

BDU:2026-05719

CVE-2026-27890

OESA-2026-2013

OESA-2026-2014

OESA-2026-2015

OESA-2026-2016

OESA-2026-2017

Affected Products

Firebird

Red Os

References · 35

• https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-6crx-4g37-7j49 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27890 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35215 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34232 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2017 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27890 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28224 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-27890 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-28214 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-65104 · Security Note
• https://bdu.fstec.ru/vul/2026-05719 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40342 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27890 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33337 · Security Note