https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-40342.htmlhttps://patchthecve.com/cve/CVE-2026-40342.htmlMon, 26 Oct 2026 22:10:00 +0000CRITICAL 9.9: Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNChttps://patchthecve.com/cve/CVE-2026-35215.htmlhttps://patchthecve.com/cve/CVE-2026-35215.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 7.5: Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the sdl_desc() function does not validate the length of a decoded SDL descriptor from a slice packet. A zero-length descriptor is later used to calculate the number of slice items, causinghttps://patchthecve.com/cve/CVE-2026-34232.htmlhttps://patchthecve.com/cve/CVE-2026-34232.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.5: Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the xdr_status_vector() function does not handle the isc_arg_cstring type when decoding an op_response packet, causing a server crash when one is encountered in the status vector. An unauthttps://patchthecve.com/cve/CVE-2026-33337.htmlhttps://patchthecve.com/cve/CVE-2026-33337.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.5: Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when deserializing a slice packet, the xdr_datum() function does not validate that a cstring length conforms to the slice descriptor bounds, allowing a cstring longer than the allocated buhttps://patchthecve.com/cve/CVE-2026-28224.htmlhttps://patchthecve.com/cve/CVE-2026-28224.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.2: Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an op_crypt_key_callback packet without prior authentication, the port_server_crypt_callback handler is not initialized, resulting in a null pointer dereference anhttps://patchthecve.com/cve/CVE-2026-28214.htmlhttps://patchthecve.com/cve/CVE-2026-28214.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 6.5: Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when parsing a Wide type clumplet, causing an infinite loop. An authenticated user with INSERT privileges https://patchthecve.com/cve/CVE-2026-28212.htmlhttps://patchthecve.com/cve/CVE-2026-28212.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.5: Firebird is an open-source relational database management system. In versions prior to 6.0.0, 5.0.4, 4.0.7 and 3.0.14, when processing an op_slice network packet, the server passes an unprepared structure containing a null pointer to the SDL_info() function, resulting in a null pointer dereference ahttps://patchthecve.com/cve/CVE-2026-27890.htmlhttps://patchthecve.com/cve/CVE-2026-27890.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.2: Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCT_specific_data segments during authentication, the server assumes segments arrive in strictly ascending order. If segments arrive out of order, the Array class's grow()