Firebird Vulnerability CVE-2026-27890: Unauthenticated Crash Risk

The National Vulnerability Database has detailed CVE-2026-27890, a critical vulnerability in Firebird, an open-source relational database management system. This flaw, present in versions prior to 5.0.4, 4.0.7, and 3.0.14, allows an unauthenticated attacker to crash the database server simply by knowing its IP address and port.

The vulnerability stems from how Firebird processes CNCT_specific_data segments during authentication. According to the National Vulnerability Database, the server incorrectly assumes these segments arrive in strictly ascending order. When segments arrive out of order, the Array class’s grow() method computes a negative size, leading to a SIGSEGV crash. This is a denial-of-service vector with a CVSS score of 8.2 (HIGH).

For defenders, this is a straightforward, high-impact issue. An attacker doesn’t need credentials or complex exploits; they just need network access. The fix is equally clear: update Firebird to versions 5.0.4, 4.0.7, or 3.0.14 immediately. This isn’t a vulnerability to patch next week; it’s a vulnerability to patch now.