PT-2026-33482 · Firebird+1 · Firebird+1

Highdyemanov · Published 2026-04-17 · Updated 2026-05-15 · CVE-2026-33337

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Firebird versions prior to 5.0.4 Firebird versions prior to 4.0.7 Firebird versions prior to 3.0.14

Description An issue exists during the deserialization of a slice packet where the xdr datum() function fails to validate that a cstring length conforms to the slice descriptor bounds. This allows a cstring longer than the allocated buffer to overflow it. An unauthenticated attacker can exploit this by sending a crafted packet to the server, potentially causing a crash or other security impact.

Recommendations Update to version 5.0.4 Update to version 4.0.7 Update to version 3.0.14

Fix

DoS

Buffer Overflow

Deserialization of Untrusted Data

Weakness Enumeration

CWE-120

CWE-502

Related Identifiers

BDU:2026-05714

CVE-2026-33337

OESA-2026-2013

OESA-2026-2014

OESA-2026-2015

OESA-2026-2016

OESA-2026-2017

Affected Products

Firebird

Red Os

References · 34

• https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-89mq-229g-x47p · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33337 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35215 · Security Note
• https://ubuntu.com/security/CVE-2026-33337 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34232 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-33337 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28224 · Security Note
• https://bdu.fstec.ru/vul/2026-05714 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-28214 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-65104 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40342 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33337 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2014 · Vendor Advisory