Vulnerability CVE-2026-33337: Information

Description

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when deserializing a slice packet, the xdr_datum() function does not validate that a cstring length conforms to the slice descriptor bounds, allowing a cstring longer than the allocated buffer to overflow it. An unauthenticated attacker can exploit this by sending a crafted packet to the server, potentially causing a crash or other security impact. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Severity: HIGH (7.5)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33337

Published: April 17, 2026

Modified: April 27, 2026

Error type identifier: CWE-120, CWE-502

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
firebird	sisyphus	5.0.4-alt1	5.0.4-alt1	ALT-PU-2026-7100-2	417095	Fixed
firebird	sisyphus_loongarch64	5.0.4-alt1	5.0.4-alt1	ALT-PU-2026-7495-1	-	Fixed
firebird	p11	5.0.4-alt1	5.0.4-alt1	ALT-PU-2026-7136-2	417164	Fixed

References to Advisories, Solutions, and Tools

Hyperlink	Resource
https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14	Release Notes
https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7	Release Notes
https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4	Release Notes
https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-89mq-229g-x47p	Exploit Vendor Advisory
BDU:2026-05714

Affected configurations:
1. cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*
  Start including
  3.0.0
  End excluding
  3.0.14
  cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*
  Start including
  4.0.0
  End excluding
  4.0.7
  cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*
  Start including
  5.0.0
  End excluding
  5.0.4

Version: v26.2.2