Firebird — CraftedSignal Threat Feed

Multiple Vulnerabilities in Firebird Database Server

hello@craftedsignal.io — Mon, 20 Apr 2026 10:29:07 +0000

The Firebird database server contains multiple unspecified vulnerabilities that could allow a remote attacker to compromise a vulnerable system. Successful exploitation could lead to arbitrary code execution with administrator privileges, sensitive information disclosure, or a denial-of-service condition. Public details are scarce, but given the potential impact, patching is highly recommended. The scope of affected Firebird installations is currently unknown, but any publicly exposed instance is a potential target. Defenders should prioritize identifying and patching vulnerable Firebird servers within their environments.

Attack Chain

Attacker identifies a vulnerable Firebird database server exposed to the network.
Attacker leverages an unspecified vulnerability in Firebird to gain initial access. This may involve sending a specially crafted network request to a vulnerable port.
Upon successful exploitation, the attacker executes arbitrary code within the context of the Firebird process.
The attacker escalates privileges to administrator level, leveraging a separate vulnerability or misconfiguration within the Firebird environment.
With administrator privileges, the attacker can access sensitive data stored within the database, including user credentials, financial records, or other confidential information.
Alternatively, the attacker may choose to inject malicious code into the database, compromising the integrity of the data.
The attacker could also trigger a denial-of-service condition by sending a flood of requests to the server or by exploiting a vulnerability that causes the server to crash.
The attacker maintains persistence by creating a new administrative user or modifying existing user accounts.

Impact

Successful exploitation of these vulnerabilities could result in complete compromise of the Firebird database server. This could lead to the theft of sensitive data, the corruption of data, or the disruption of services that rely on the database. The impact depends on the sensitivity of the data stored in the database and the criticality of the services that depend on it. A successful attack could result in significant financial losses, reputational damage, and legal liabilities.

Recommendation

Monitor network traffic for suspicious activity targeting Firebird database servers. Use network intrusion detection systems (NIDS) to detect and block malicious traffic (network_connection category).
Implement strict access controls to limit access to Firebird database servers to only authorized users and systems.
Apply any available patches or updates for Firebird to address these vulnerabilities as soon as possible.
Deploy the Sigma rules provided to detect potential exploitation attempts (process_creation, network_connection categories).

Firebird Server Denial-of-Service Vulnerability (CVE-2026-28224)

hello@craftedsignal.io — Sat, 18 Apr 2026 10:00:00 +0000

CVE-2026-28224 describes a denial-of-service vulnerability affecting Firebird, an open-source relational database management system. The vulnerability exists in versions prior to 5.0.4, 4.0.7, and 3.0.14. An unauthenticated attacker can exploit this vulnerability by sending a crafted op_crypt_key_callback packet to the server. When the server receives this packet without prior authentication, the port_server_crypt_callback handler is not initialized, resulting in a null pointer dereference. This leads to a server crash, effectively causing a denial-of-service condition. The attacker only needs to know the server’s IP address and port to trigger this vulnerability. The vulnerability has been patched in Firebird versions 5.0.4, 4.0.7 and 3.0.14.

Attack Chain

The attacker identifies a vulnerable Firebird server by scanning for exposed ports (typically 3050).
The attacker establishes a TCP connection with the targeted Firebird server on the identified port.
The attacker crafts a malicious op_crypt_key_callback packet. This packet does not require prior authentication.
The attacker sends the crafted op_crypt_key_callback packet to the Firebird server.
Upon receiving the packet, the server attempts to process the request in the port_server_crypt_callback handler.
Because no prior authentication has occurred, the port_server_crypt_callback handler is not properly initialized, leading to a null pointer dereference.
The null pointer dereference causes the Firebird server process to crash.
The Firebird database server becomes unavailable, resulting in a denial-of-service condition for legitimate users.

Impact

Successful exploitation of CVE-2026-28224 results in a denial-of-service condition, rendering the Firebird database server unavailable. This can disrupt applications and services that rely on the database, leading to data access issues, application downtime, and potential data loss if proper backup and recovery mechanisms are not in place. The number of affected organizations depends on the prevalence of vulnerable Firebird versions and their exposure to the network.

Recommendation

Upgrade Firebird servers to versions 5.0.4, 4.0.7, or 3.0.14 or later to patch CVE-2026-28224.
Deploy the Sigma rule “Detect Unauthenticated Firebird Crypt Callback” to your SIEM to identify potential exploitation attempts targeting this vulnerability.
Implement network segmentation and access control lists (ACLs) to restrict access to Firebird servers from untrusted networks, mitigating the risk of unauthorized exploitation (network_connection logs).
Monitor network traffic for suspicious op_crypt_key_callback packets being sent to Firebird servers, particularly from untrusted sources (network_connection logs).

Firebird Path Traversal Vulnerability Leads to Code Execution (CVE-2026-40342)

hello@craftedsignal.io — Fri, 17 Apr 2026 20:16:35 +0000

Firebird, an open-source relational database management system, is vulnerable to a path traversal flaw (CVE-2026-40342) in versions prior to 5.0.4, 4.0.7, and 3.0.14. This vulnerability resides within the external engine plugin loader. The loader concatenates a user-supplied engine name into a filesystem path without proper sanitization, leaving it open to path traversal attacks. An authenticated user with CREATE FUNCTION privileges can craft a malicious ENGINE name containing path separators and .. components. This allows them to load an arbitrary shared library from anywhere on the filesystem. The library’s initialization code executes immediately upon loading, before Firebird can validate the module, effectively granting code execution under the security context of the server’s operating system account. Upgrading to versions 5.0.4, 4.0.7, or 3.0.14 resolves this issue.

Attack Chain

Attacker authenticates to the Firebird database server with an account possessing CREATE FUNCTION privileges.
Attacker crafts a malicious ENGINE name that includes path traversal sequences (e.g., ../../../../).
The attacker uses the crafted ENGINE name in a CREATE FUNCTION statement, specifying a path to an arbitrary shared library on the filesystem. For example, CREATE FUNCTION evil_func RETURNS INTEGER ENGINE '/path/to/evil/../../../../tmp/evil.so'.
The Firebird server’s plugin loader concatenates the provided ENGINE name into a filesystem path without proper validation.
The Firebird server attempts to load the shared library from the attacker-controlled path, effectively bypassing intended access controls.
The operating system loads the shared library into the Firebird server’s process.
The shared library’s initialization code executes immediately, granting the attacker arbitrary code execution within the context of the Firebird server process.
The attacker gains control of the Firebird server’s OS account, potentially leading to data exfiltration, system compromise, or denial of service.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the Firebird server with the privileges of the operating system account running the Firebird service. This can lead to full system compromise, including data exfiltration, modification, or destruction. Given the high CVSS score of 9.9, this vulnerability poses a critical risk to organizations using vulnerable Firebird versions. The impact could range from complete database compromise to lateral movement within the network, depending on the privileges of the Firebird service account.

Recommendation

Upgrade Firebird servers to versions 5.0.4, 4.0.7, or 3.0.14 to patch CVE-2026-40342.
Monitor Firebird server logs for CREATE FUNCTION statements with suspicious ENGINE names containing path traversal sequences, and deploy the Sigma rule Detect Firebird Create Function Path Traversal to your SIEM.
Implement strict access controls to limit CREATE FUNCTION privileges to only authorized users, and enable audit logging on all Firebird database servers to monitor user activity.

Firebird Database Server Slice Packet Deserialization Buffer Overflow

hello@craftedsignal.io — Fri, 17 Apr 2026 19:16:36 +0000

Firebird, a widely used open-source relational database management system, is susceptible to a critical buffer overflow vulnerability. Present in versions prior to 5.0.4, 4.0.7, and 3.0.14, the vulnerability resides within the xdr_datum() function, responsible for deserializing slice packets. This function fails to adequately validate the length of cstring data against the slice descriptor bounds. Consequently, an attacker can craft a malicious packet containing an oversized cstring, leading to a buffer overflow. An unauthenticated attacker exploiting this vulnerability can send a crafted packet to the Firebird server, potentially causing a denial-of-service condition via a crash or, more seriously, achieving arbitrary code execution on the affected system. Organizations utilizing vulnerable Firebird versions are urged to upgrade to versions 5.0.4, 4.0.7, or 3.0.14 to mitigate this risk.

Attack Chain

The attacker identifies a Firebird server running a vulnerable version (prior to 5.0.4, 4.0.7, or 3.0.14).
The attacker crafts a malicious slice packet designed to exploit the xdr_datum() function’s insufficient bounds checking. This packet includes an overly long cstring.
The attacker establishes a network connection to the Firebird server.
The attacker transmits the crafted malicious slice packet to the Firebird server.
The Firebird server’s xdr_datum() function processes the malicious packet without proper cstring length validation.
The oversized cstring overflows the allocated buffer during deserialization.
The buffer overflow corrupts adjacent memory regions, potentially overwriting critical data structures or executable code.
Depending on the overwritten memory, the server either crashes, leading to denial of service, or the attacker achieves arbitrary code execution, enabling them to gain control of the system.

Impact

Successful exploitation of this vulnerability could lead to a denial-of-service condition due to a server crash, disrupting database services and impacting applications reliant on the Firebird database. In a more severe scenario, an attacker could gain arbitrary code execution on the server, allowing them to potentially steal sensitive data, compromise the integrity of the database, or use the compromised server as a launchpad for further attacks within the network. While specific victim counts are unavailable, the widespread use of Firebird implies a significant potential impact across various sectors.

Recommendation

Immediately upgrade Firebird servers to versions 5.0.4, 4.0.7, or 3.0.14 to patch CVE-2026-33337 and eliminate the buffer overflow vulnerability.
Deploy the Sigma rule “Detect Firebird Slice Packet Overflow Attempt” to identify potential exploitation attempts based on anomalous network traffic patterns.
Monitor network traffic for connections to Firebird servers originating from unexpected or untrusted sources to detect potential reconnaissance or exploitation attempts. Enable network connection logging to support this monitoring.

Firebird FB3 Client Library Information Leak (CVE-2025-65104)

hello@craftedsignal.io — Fri, 17 Apr 2026 18:16:30 +0000

CVE-2025-65104 describes an information leak vulnerability affecting the Firebird open-source relational database management system. The vulnerability exists within the FB3 versions of the client library. When an FB3 client communicates with a Firebird FB4 or higher server, the client library incorrectly places data length values into the XSQLDA (SQL Data Area) fields. This incorrect handling of data lengths can result in an information leak, potentially exposing sensitive data to an attacker with local access. The vulnerability was reported in April 2026. The recommended solution is to upgrade the client library to FB4 or a later version. This vulnerability is significant because it could allow unauthorized access to sensitive information stored within the Firebird database.

Attack Chain

Attacker gains local access to a system with a Firebird FB3 client library installed.
Attacker identifies a Firebird FB4 or higher server to target.
Attacker crafts a malicious SQL query or uses an existing application to interact with the server.
The FB3 client library processes the query and prepares the XSQLDA structure.
Due to the vulnerability, the FB3 client library places incorrect data length values into the XSQLDA fields.
The server responds with data, and the client uses the incorrect length values to interpret the response.
The attacker leverages the incorrect data length values to extract more data than intended, leading to an information leak.
The attacker exfiltrates the leaked information.

Impact

Successful exploitation of CVE-2025-65104 results in an information leak. An attacker with local access can potentially extract sensitive data from a Firebird database server. While the exact impact depends on the data stored, it could include user credentials, financial data, or other confidential information. This could lead to further compromise of systems and data. The vulnerability exists because of incorrect data length calculations when FB3 clients communicate with FB4+ servers, which highlights the importance of maintaining up-to-date client libraries.

Recommendation

Upgrade all Firebird client libraries to version FB4 or higher to remediate CVE-2025-65104 as recommended by the vendor.
Monitor network connections and process creations involving fbclient.dll or libfbclient.so (depending on the OS) to detect suspicious activity related to Firebird database interactions.
Implement the Sigma rule provided below to detect suspicious process execution related to Firebird clients.