PT-2026-33484 · Firebird+1 · Firebird+1

Highdyemanov · CVE-2026-35215 · Published 2026-04-17 · Updated 2026-05-15

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Firebird versions prior to 5.0.4 Firebird versions prior to 4.0.7 Firebird versions prior to 3.0.14

Description The sdl desc() function fails to validate the length of a decoded SDL descriptor from a slice packet. A zero-length descriptor can be used to calculate the number of slice items, leading to a division by zero. An unauthenticated attacker can trigger a server crash by sending a specially crafted slice packet.

Recommendations Update to version 5.0.4 Update to version 4.0.7 Update to version 3.0.14

Exploit

Fix

DoS

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

BDU:2026-05716

CVE-2026-35215

GHSA-G99W-PRQ5-29C6

OESA-2026-2013

OESA-2026-2014

OESA-2026-2015

OESA-2026-2016

OESA-2026-2017

SUSE-SU-2026:1868-1

Affected Products

Firebird

Red Os

References · 37

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35215.json · Exploit
• https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-g99w-prq5-29c6 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40342 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-35215 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-65104 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2016 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05716 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-35215 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35215 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28224 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-28212 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35215 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34232 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2017 · Vendor Advisory