The ClumpletReader::getClumpletSize() function in Firebird 5.0 and earlier can overflow the totalLength value when parsing a Wide type clumplet, which leads to an infinite loop in the server’s batch creation process. An attacker with INSERT privileges on any table can construct a malicious Batch Parameter Block that triggers this overflow, causing the server to hang and denying service to legitimate users. The weakness is an integer overflow (CWE-190) that results in an unbounded loop (CWE-835).

The vulnerability is present in FirebirdSQL Firebird for all releases prior to 5.0.4, 4.0.7, and 3.0.14. Versions 5.0.4, 4.0.7, and 3.0.14 contain the fix and are not affected.

The CVSS score of 6 indicates medium severity. There is no EPSS data, and the issue is not listed in the KEV catalog. Exploitation requires an authenticated user with INSERT authority, so the attack vector is likely internal. While the vulnerability does not allow arbitrary code execution or data exfiltration, the ability to cause a server hang can disrupt business operations, especially in high‑traffic environments.