CVE-2026-27890
Segmentation Fault in Firebird Authentication via Out-of-Order Data
Publication date: 2026-04-17
Last updated on: 2026-04-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| firebirdsql | firebird | to 3.0.14 (exc) |
| firebirdsql | firebird | From 4.0.0 (inc) to 4.0.7 (exc) |
| firebirdsql | firebird | From 5.0.0 (inc) to 5.0.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Firebird open-source relational database management system in versions prior to 5.0.4, 4.0.7, and 3.0.14. During authentication, the server processes CNCT_specific_data segments and assumes these segments arrive in strictly ascending order. If the segments arrive out of order, the Array class's grow() method calculates a negative size value, which causes the server to crash with a SIGSEGV (segmentation fault).
An unauthenticated attacker who only knows the server's IP address and port can exploit this flaw to cause the server to crash.
How can this vulnerability impact me? :
This vulnerability can be exploited by an unauthenticated attacker to cause a denial of service by crashing the Firebird database server. This crash can disrupt availability of the database services, potentially leading to downtime and loss of access to data for legitimate users.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Firebird to version 5.0.4, 4.0.7, or 3.0.14 or later, as these versions contain the fix for the issue.
Additionally, consider restricting network access to the Firebird server to trusted hosts only, to reduce the risk of exploitation by unauthenticated attackers.