Null Pointer Dereference Vulnerability in Firebird Open-Source Database
CVE-2026-28212
7.5HIGH
What is CVE-2026-28212?
Firebird, the open-source relational database management system, is susceptible to a null pointer dereference issue in versions prior to 6.0.0, 5.0.4, 4.0.7, and 3.0.14. This vulnerability arises during the processing of an op_slice network packet, where an unprepared structure with a null pointer is passed to the SDL_info() function. Consequently, this can lead to a crash of the server when an unauthenticated attacker sends a specially crafted packet to the server port. Users are advised to upgrade to the patched versions to mitigate this security risk.
Affected Version(s)
firebird < 3.0.14 < 3.0.14
firebird >= 4.0.0, < 4.0.7 < 4.0.0, 4.0.7
firebird >= 5.0.0, < 5.0.4 < 5.0.0, 5.0.4