Null Pointer Dereference Vulnerability in Firebird Database by FirebirdSQL
CVE-2026-28224
8.2HIGH
What is CVE-2026-28224?
An unauthenticated attacker can exploit a vulnerability in the Firebird relational database management system, affecting versions prior to 5.0.4, 4.0.7, and 3.0.14. When the server receives an op_crypt_key_callback packet without prior authentication, it leads to the port_server_crypt_callback handler not being initialized. This results in a null pointer dereference and subsequently causes the server to crash. To mitigate this issue, users should update to the latest versions as outlined in the security advisories.
Affected Version(s)
firebird >= 3.0.0, < 3.0.14 < 3.0.0, 3.0.14
firebird >= 4.0.0, < 4.0.7 < 4.0.0, 4.0.7
firebird >= 5.0.0, < 5.0.4 < 5.0.0, 5.0.4