Firebird DB Division by Zero Vulnerability Crashes Servers

The National Vulnerability Database has identified CVE-2026-35215, a critical division-by-zero flaw in Firebird’s sdl_desc() function. Versions prior to 5.0.4, 4.0.7, and 3.0.14 are affected. The vulnerability stems from a failure to validate the length of a decoded SDL descriptor from a slice packet. This allows an unauthenticated attacker to send a crafted packet, trigger a division by zero, and crash the database server.

This vulnerability carries a HIGH CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The lack of authentication and network-exploitability means any attacker with network access to the Firebird instance can cause a denial-of-service condition. For organizations relying on Firebird, this presents a direct path to disrupting critical database operations.

Defenders must prioritize patching Firebird instances to versions 5.0.4, 4.0.7, or 3.0.14 immediately. Given the ease of exploitation and high impact, unpatched systems are prime targets for disruption. Network segmentation and access controls should be reviewed to limit exposure of Firebird servers to untrusted networks.