CVE-2026-28214

Katalog CVE

CVSS 6.5 · Medium EPSS 0,59%

Kerentanan Integer Overflow or Wraparound pada firebirdsql firebird. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when parsing a Wide type clumplet, causing an infinite loop. An authenticated user with INSERT privileges on any table can exploit this via a crafted Batch Parameter Block to cause a denial of service against the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Rincian

Terbit di NVD

17 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7cq5-994r-jhrf exploit · advisory vendor
• https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14 release notes
• https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7 release notes
• https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4 release notes