CVE-2026-28224

Firebird Null Pointer Dereference via CryptCallback causes DOS

State: Published
Severity: 8.2 High
Published: Apr 17, 2026
Updated: Apr 17, 2026
Reserved: Feb 25, 2026

Description

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an op_crypt_key_callback packet without prior authentication, the port_server_crypt_callback handler is not initialized, resulting in a null pointer dereference and server crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H	GitHub_M

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
firebirdFirebirdSQL	>= 3.0.0, < 3.0.14Affected >= 4.0.0, < 4.0.7Affected >= 5.0.0, < 5.0.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.