CVE-2026-33337

The record

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when deserializing a slice packet, the xdr_datum() function does not validate that a cstring length conforms to the slice descriptor bounds, allowing a cstring longer than the allocated buffer to overflow it. An unauthenticated attacker can exploit this by sending a crafted packet to the server, potentially causing a crash or other security impact. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Affected packages

Related vulnerabilities

• CVE-2026-112108 A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. CWE-120
• CVE-2026-90804 A vulnerability was detected in GNU Binutils 2.47. CWE-120
• CVE-2026-90803 A security vulnerability has been detected in GNU Binutils 2.47. CWE-120
• CVE-2026-90801 A security flaw has been discovered in GNU Binutils 2.47. CWE-120
• CVE-2026-42808 An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11. The host… CWE-120
• CVE-2026-87931 A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral… CWE-120
• CVE-2026-71613 Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an… CWE-120
• CVE-2026-86166 A vulnerability was determined in Tenda HG10 300001138. CWE-120