CVE-2026-27890

Katalog CVE

CVSS 8.2 · High EPSS 0,72%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada firebirdsql firebird. Skor CVSS 3.1 8.2 (High) menurut github.com.

Deskripsi (NVD)

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCT_specific_data segments during authentication, the server assumes segments arrive in strictly ascending order. If segments arrive out of order, the Array class's grow() method computes a negative size value, causing a SIGSEGV crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Rincian

Terbit di NVD

17 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,72% peluang dieksploitasi; lebih tinggi dari 52,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-6crx-4g37-7j49 exploit · advisory vendor
• https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14 release notes
• https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7 release notes
• https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4 release notes