CVE-2026-33337

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when deserializing a slice packet, the xdr_datum() function does not validate that a cstring length conforms to the slice descriptor bounds, allowing a cstring longer than the allocated buffer to overflow it. An unauthenticated attacker can exploit this by sending a crafted packet to the server, potentially causing a crash or other security impact. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-120 CWE-502

Affected software

Vendor	Product	Versions
FirebirdSQL	firebird	>= 3.0.0, < 3.0.14; >= 4.0.0, < 4.0.7; >= 5.0.0, < 5.0.4

References

https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14Release Notes
https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7Release Notes
https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4Release Notes
https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-89mq-229g-x47pExploit, Vendor Advisory

Timeline

Published: Apr 17, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-33348.8The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' para CVE-2026-333409.1LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSR CVE-2026-333436.5etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, an authenticated us CVE-2026-333448.1Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added V CVE-2026-333456.5solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/{org}/projects CVE-2026-333468.7OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, a stored cross-si CVE-2026-333476.1league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is CVE-2026-333485.4OpenEMR is a free and open source electronic health records and medical practice management application. Users with the `Notes - my encounte CVE-2026-333495.9fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before v CVE-2026-33355.3The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1 via the `/wp-content/plugi CVE-2026-333507.5LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neur CVE-2026-333519.1WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability exists in `plugin/Li