CVE-2026-28224
Null Pointer Dereference in Firebird Server Causes Denial of Service
Publication date: 2026-04-17
Last updated on: 2026-04-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| firebirdsql | firebird | to 3.0.14 (exc) |
| firebirdsql | firebird | From 4.0.0 (inc) to 4.0.7 (exc) |
| firebirdsql | firebird | From 5.0.0 (inc) to 5.0.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an unauthenticated attacker to crash the Firebird server by sending a specially crafted packet, resulting in a denial of service. However, there is no information provided about any impact on data confidentiality or integrity, nor about any direct effects on compliance with standards such as GDPR or HIPAA.
Since the vulnerability causes a server crash without data breach or unauthorized data access, its impact on compliance with regulations that focus on data protection and privacy is likely limited to availability concerns.
Can you explain this vulnerability to me?
This vulnerability exists in Firebird, an open-source relational database management system, in versions prior to 5.0.4, 4.0.7, and 3.0.14. When the server receives an op_crypt_key_callback packet without prior authentication, the port_server_crypt_callback handler is not initialized. This leads to a null pointer dereference, causing the server to crash.
An attacker who is unauthenticated and only knows the server's IP address and port can exploit this vulnerability to crash the server.
How can this vulnerability impact me? :
This vulnerability can be exploited by an unauthenticated attacker to cause a denial of service by crashing the Firebird server. This can lead to service disruption, affecting availability and potentially causing downtime for applications relying on the database.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your Firebird server to version 5.0.4, 4.0.7, or 3.0.14 or later, as these versions contain the fix for the issue.