CVE-2026-33337: Firebird has a buffer overflow when parsing corrupted slice packets
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when deserializing a slice packet, the xdrdatum() function does not validate that a cstring length conforms to the slice descriptor bounds, allowing a cstring longer than the allocated buffer to overflow it. An unauthenticated attacker can exploit this by sending a crafted packet to the server, potentially causing a crash or other security impact. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33337?
CVE-2026-33337 has a severity rating that indicates a critical vulnerability due to a buffer overflow potentially leading to arbitrary code execution.
How do I fix CVE-2026-33337?
To fix CVE-2026-33337, upgrade Firebird to versions 5.0.4, 4.0.7, or 3.0.14 or later.
What versions of Firebird are affected by CVE-2026-33337?
Firebird versions prior to 5.0.4, 4.0.7, and 3.0.14 are affected by CVE-2026-33337.
What type of vulnerability is CVE-2026-33337?
CVE-2026-33337 is a buffer overflow vulnerability that occurs during the deserialization of corrupted slice packets.
What are the potential impacts of CVE-2026-33337?
The potential impacts of CVE-2026-33337 include system crashes and execution of arbitrary code, creating significant security risks.