CVE-2026-35215: Firebirdsql Firebird vulnerability (CVSS 7.5)

Description

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the sdl_desc() function does not validate the length of a decoded SDL descriptor from a slice packet. A zero-length descriptor is later used to calculate the number of slice items, causing a division by zero. An unauthenticated attacker can exploit this by sending a crafted slice packet to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Firebirdsql Firebird≥ 3.0.0 < 3.0.14 · ≥ 4.0.0 < 4.0.7 · ≥ 5.0.0 < 5.0.4

Remediation

Fixed in

Firebirdsql Firebird≥ 3.0.14

Patch & vendor advisories

https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-g99w-prq5-29c6

References

https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14Release Notes
https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7Release Notes
https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4Release Notes
https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-g99w-prq5-29c6ExploitVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-35215 being actively exploited?

CVE-2026-35215 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.69%.

How severe is CVE-2026-35215?

CVE-2026-35215 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 0.69% probability of exploitation.

Which products are affected by CVE-2026-35215?

Affected products include Firebirdsql Firebird.

How do I fix CVE-2026-35215?

Upgrade affected software to a fixed version, for example Firebirdsql Firebird 3.0.14 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-35215 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo