The vulnerability is a lack of validation for the length of a decoded SDL descriptor received in a slice packet. A zero‑length descriptor is later used to compute the number of slice items, triggering a division by zero that crashes the Firebird server and results in a denial of service. The weakness is a classic divide‑by‑zero error (CWE‑369), allowing an attacker to interrupt service without compromising confidentiality or integrity.

FirebirdSQL Firebird is affected in all releases prior to 5.0.4, 4.0.7 and 3.0.14. The problem is present in the sdl_desc() function used by the database engine and is only mitigated by the corresponding vendor releases.

The CVSS score of 7.5 indicates a moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, so there is no publicly known exploit at this time. Nevertheless, the attack is straightforward: an unauthenticated client can send a malicious slice packet over the network to any accessible Firebird instance, causing an immediate service crash. Attackers would benefit from unrestricted network reach to the database port, and no special privileges are required.