Input validation error in Firebird - CVE-2026-35215

Vulnerability identifier: #VU126550

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-35215

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in sdl_desc() when processing a crafted slice packet. A remote attacker can send a specially crafted slice packet to cause a denial of service.

The issue results from a division by zero when the decoded SDL descriptor length is later used to calculate the number of items in the slice.

Firebird
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Package Hub 15
Anolis OS
firebird-debugsource
firebird-debuginfo
libfbclient-devel
firebird-utils-debuginfo
firebird-server-debuginfo
libfbclient2-debuginfo
libib_util-devel
firebird-server
firebird-utils
libib_util-debuginfo
libfbclient2
firebird-examples
libib_util
firebird
libib-util
libfbclient2-devel
firebird-devel
firebird-doc

Install security update from vendor's website.

Firebird - addressed in versions 3.0.14, 4.0.7, 5.0.4
firebird-debugsource - update to 3.0.14.33856-150200.3.9.1
firebird-debuginfo - update to 3.0.14.33856-150200.3.9.1
libfbclient-devel - update to 3.0.14.33856-150200.3.9.1
firebird-utils-debuginfo - update to 3.0.14.33856-150200.3.9.1
firebird-server-debuginfo - update to 3.0.14.33856-150200.3.9.1
libfbclient2-debuginfo - update to 3.0.14.33856-150200.3.9.1
libib_util-devel - update to 3.0.14.33856-150200.3.9.1
firebird-server - update to 3.0.14.33856-150200.3.9.1
firebird-utils - update to 3.0.14.33856-150200.3.9.1
libib_util-debuginfo - update to 3.0.14.33856-150200.3.9.1
libfbclient2 - update to 3.0.14.33856-150200.3.9.1
firebird-examples - update to 3.0.14.33856-150200.3.9.1
libib_util - update to 3.0.14.33856-150200.3.9.1
firebird - update to 3.0.14.33856-150200.3.9.1
firebird - update to 4.0.7.3271-1.1
libfbclient2 - update to 4.0.7.3271-1.1
firebird-utils - update to 4.0.7.3271-1.1
libib-util - update to 4.0.7.3271-1.1
libfbclient2-devel - update to 4.0.7.3271-1.1
firebird-devel - update to 4.0.7.3271-1.1
firebird-doc - update to 4.0.7.3271-1.1
firebird-examples - update to 4.0.7.3271-1.1

• https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-g99w-prq5-29c6

• Multiple vulnerabilities in Firebird
• SUSE update for firebird
• Anolis OS update for firebird