PT-2026-33483 · Firebirdsql · Firebird

Published 2026-04-17 · Updated 2026-04-17 · CVE-2026-34232

NVD

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the xdr status vector() function does not handle the isc arg cstring type when decoding an op response packet, causing a server crash when one is encountered in the status vector. An unauthenticated attacker can exploit this by sending a crafted op response packet to the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Fix

Weakness Enumeration

CWE-228

Related Identifiers

CVE-2026-34232

Affected Products

Firebird

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-34232 · Security Note
• https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14 · Note
• https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4 · Note
• https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7 · Note
• https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7jq3-6j3c-5cm2 · Note