How severe is CVE-2026-40342?

CVE-2026-40342 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-40342 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (48th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-40342?

CVE-2026-40342 affects Firebirdsql Firebird. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-40342?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-40342 have an EU (EUVD) identifier?

Yes. CVE-2026-40342 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-23496.

When was CVE-2026-40342 published?

CVE-2026-40342 was published on 2026-04-17 and last updated on 2026-06-17.

CVE-2026-40342

CVE-2026-40342 is a critical-severity vulnerability in Firebirdsql Firebird with a CVSS 3.x base score of 9.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-22.

Key facts

Severity: Critical (CVSS 3.x base score 9.9)
EPSS exploit prediction: 1% (48th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-23496
Weakness: CWE-22
Affected product: Firebirdsql Firebird
Published: 2026-04-17
Last modified: 2026-06-17

Description

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNCTION privileges can use a crafted ENGINE name to load an arbitrary shared library from anywhere on the filesystem via path traversal. The library's initialization code executes immediately during loading, before Firebird validates the module, achieving code execution as the server's OS account. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Frequently asked questions

What is CVE-2026-40342?: Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNCTION privileges can use a crafted ENGINE name to load an arbitrary shared library from anywhere on the filesystem via path traversal. The library's initialization code executes immediately during loading, before Firebird validates the module, achieving code execution as the server's OS account. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
How severe is CVE-2026-40342?: CVE-2026-40342 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-40342 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (48th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-40342?: CVE-2026-40342 affects Firebirdsql Firebird. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-40342?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-40342 have an EU (EUVD) identifier?: Yes. CVE-2026-40342 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-23496.
When was CVE-2026-40342 published?: CVE-2026-40342 was published on 2026-04-17 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*

More vulnerabilities in Firebirdsql Firebird

CVE-2008-0467 — Critical (CVSS 10.0): Stack-based buffer overflow in Firebird before 2.0.4, and 2.1.x before 2.1.0 RC1, might allow remote attackers to…
CVE-2007-4992 — Critical (CVSS 10.0): Stack-based buffer overflow in the process_packet function in fbserver.exe in Firebird SQL 2.0.2 allows remote…
CVE-2007-5246 — Critical (CVSS 10.0): Multiple stack-based buffer overflows in Firebird LI 2.0.0.12748 and 2.0.1.12855, and WI 2.0.0.12748 and 2.0.1.12855,…
CVE-2007-5245 — Critical (CVSS 10.0): Multiple stack-based buffer overflows in Firebird LI 1.5.3.4870 and 1.5.4.4910, and WI 1.5.3.4870 and 1.5.4.4910, allow…
CVE-2007-3181 — Critical (CVSS 10.0): Buffer overflow in fbserver.exe in Firebird SQL 2 before 2.0.1 allows remote attackers to execute arbitrary code via a…
CVE-2001-0008 — Critical (CVSS 10.0): Backdoor account in Interbase database server allows remote attackers to overwrite arbitrary files using stored…

All CVEs affecting Firebirdsql Firebird →

Other CWE-22 (Path Traversal) vulnerabilities

CVE-2026-48282 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted…
CVE-2026-54917 — Critical (CVSS 10.0): SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the…
CVE-2026-11429 — Critical (CVSS 10.0): Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file…
CVE-2026-34909 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to…
CVE-2026-7411 — Critical (CVSS 10.0): In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel…
CVE-2026-36767 — Critical (CVSS 10.0): A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary…

Browse all CWE-22 (Path Traversal) vulnerabilities →