CVE-2026-28214: CWE-190: Integer Overflow or Wraparound in FirebirdSQL firebird
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when parsing a Wide type clumplet, causing an infinite loop. An authenticated user with INSERT privileges on any table can exploit this via a crafted Batch Parameter Block to cause a denial of service against the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
AI Analysis
Technical Summary
FirebirdSQL firebird versions before 5.0.4, 4.0.7, and 3.0.14 contain an integer overflow vulnerability in the ClumpletReader::getClumpletSize() function. When parsing a Wide type clumplet, the totalLength value can overflow, resulting in an infinite loop. This can be triggered by an authenticated user with INSERT privileges using a specially crafted Batch Parameter Block, causing a denial of service condition. The issue is addressed by updates in the specified fixed versions.
Potential Impact
Exploitation allows an authenticated user with INSERT privileges to cause a denial of service by triggering an infinite loop in the server process. This disrupts availability but does not indicate data confidentiality or integrity impacts. No known exploits in the wild have been reported.
Mitigation Recommendations
This vulnerability is fixed in FirebirdSQL versions 5.0.4, 4.0.7, and 3.0.14. Users should upgrade to these or later versions to remediate the issue. Since this is not a cloud service, remediation requires applying the official updates. Patch status is confirmed by the vendor advisory embedded in the description.
CVE-2026-28214: CWE-190: Integer Overflow or Wraparound in FirebirdSQL firebird
Description
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when parsing a Wide type clumplet, causing an infinite loop. An authenticated user with INSERT privileges on any table can exploit this via a crafted Batch Parameter Block to cause a denial of service against the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
CVSS v4.0
Score 6.0medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FirebirdSQL firebird versions before 5.0.4, 4.0.7, and 3.0.14 contain an integer overflow vulnerability in the ClumpletReader::getClumpletSize() function. When parsing a Wide type clumplet, the totalLength value can overflow, resulting in an infinite loop. This can be triggered by an authenticated user with INSERT privileges using a specially crafted Batch Parameter Block, causing a denial of service condition. The issue is addressed by updates in the specified fixed versions.
Potential Impact
Exploitation allows an authenticated user with INSERT privileges to cause a denial of service by triggering an infinite loop in the server process. This disrupts availability but does not indicate data confidentiality or integrity impacts. No known exploits in the wild have been reported.
Mitigation Recommendations
This vulnerability is fixed in FirebirdSQL versions 5.0.4, 4.0.7, and 3.0.14. Users should upgrade to these or later versions to remediate the issue. Since this is not a cloud service, remediation requires applying the official updates. Patch status is confirmed by the vendor advisory embedded in the description.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-02-25T15:28:40.649Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e28194bdfbbecc597b95d0
Added to database: 4/17/2026, 6:53:08 PM
Last enriched: 4/25/2026, 2:59:20 AM
Last updated: 5/28/2026, 9:38:16 PM
Views: 80
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.