Firebird versions prior to 5.0.4, 4.0.7, and 3.0.14 assume that CNCT_specific_data segments arrive in strict ascending order during authentication. When these segments are received out of order, the Array class’s grow() method computes a negative size, resulting in a segmentation fault that crashes the server. This buffer and size overflow flaw (CWE-119, CWE-787) allows an attacker who only knows the server’s IP and port to cause an unauthenticated denial of service by repeatedly triggering the crash.

All FirebirdSQL Firebird database servers running any of the following releases before 5.0.4, before 4.0.7, or before 3.0.14 are affected. These include the 5.x, 4.x, and 3.x branches of Firebird.

The CVSS score of 8.2 classifies the flaw as high severity, and the EPSS score is not available. The flaw is not listed in CISA KEV. Because the attack requires only knowledge of the server’s IP and port and does not need authentication, the potential for exploitation remains high. An unauthenticated attacker can repeatedly reset the database service, creating a significant availability risk for services that depend on Firebird. The lack of a current KEV listing suggests no widespread public exploitation yet, but the high CVSS and ease of exploit warrant swift remediation.