CVE-2026-28224

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28224", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T15:28:40.650Z", "datePublished": "2026-04-17T18:38:58.138Z", "dateUpdated": "2026-04-17T19:31:38.952Z"}, "containers": {"cna": {"title": "Firebird Null Pointer Dereference via CryptCallback causes DOS", "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "lang": "en", "description": "CWE-476: NULL Pointer Dereference", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-xrcw-wpjx-pr95", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-xrcw-wpjx-pr95"}, {"name": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14", "tags": ["x_refsource_MISC"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14"}, {"name": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7"}, {"name": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4"}], "affected": [{"vendor": "FirebirdSQL", "product": "firebird", "versions": [{"version": ">= 3.0.0, < 3.0.14", "status": "affected"}, {"version": ">= 4.0.0, < 4.0.7", "status": "affected"}, {"version": ">= 5.0.0, < 5.0.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T18:38:58.138Z"}, "descriptions": [{"lang": "en", "value": "Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an op_crypt_key_callback packet without prior authentication, the port_server_crypt_callback handler is not initialized, resulting in a null pointer dereference and server crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14."}], "source": {"advisory": "GHSA-xrcw-wpjx-pr95", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-xrcw-wpjx-pr95", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-17T19:31:35.290539Z", "id": "CVE-2026-28224", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T19:31:38.952Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28224", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-17T19:31:35.290539Z"}}}], "references": [{"url": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-xrcw-wpjx-pr95", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T19:31:27.860Z"}}], "cna": {"title": "Firebird Null Pointer Dereference via CryptCallback causes DOS", "source": {"advisory": "GHSA-xrcw-wpjx-pr95", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "FirebirdSQL", "product": "firebird", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.0.14"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.7"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.4"}]}], "references": [{"url": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-xrcw-wpjx-pr95", "name": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-xrcw-wpjx-pr95", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14", "name": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7", "name": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4", "name": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an op_crypt_key_callback packet without prior authentication, the port_server_crypt_callback handler is not initialized, resulting in a null pointer dereference and server crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476: NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T18:38:58.138Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28224", "state": "PUBLISHED", "dateUpdated": "2026-04-17T19:31:38.952Z", "dateReserved": "2026-02-25T15:28:40.650Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-17T18:38:58.138Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "firebird", "vendor": "FirebirdSQL", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.0.14"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.7"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*", "matchCriteriaId": "53D811A2-F880-46E9-9F7F-1CE3AC487F67", "versionEndExcluding": "3.0.14", "vulnerable": true}, {"criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4BC24D2-FBF7-4308-9914-6079DBDF88FA", "versionEndExcluding": "4.0.7", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*", "matchCriteriaId": "938978A3-90BE-4223-BDFC-5310A7C78D9B", "versionEndExcluding": "5.0.4", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an op_crypt_key_callback packet without prior authentication, the port_server_crypt_callback handler is not initialized, resulting in a null pointer dereference and server crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14."}, {"lang": "es", "value": "Firebird es un sistema de gesti\u00f3n de base de datos relacional de c\u00f3digo abierto. En versiones anteriores a 5.0.4, 4.0.7 y 3.0.14, cuando el servidor recibe un paquete op_crypt_key_callback sin autenticaci\u00f3n previa, el gestor port_server_crypt_callback no se inicializa, lo que resulta en una desreferencia de puntero nulo y un fallo del servidor. Un atacante no autenticado que conoce solo la IP y el puerto del servidor puede explotar esto para provocar un fallo en el servidor. Este problema ha sido solucionado en las versiones 5.0.4, 4.0.7 y 3.0.14."}], "id": "CVE-2026-28224", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28224", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-17T19:31:35.290539Z", "version": "2.0.3"}}]}, "published": "2026-04-17T19:16:35.983", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-xrcw-wpjx-pr95"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-xrcw-wpjx-pr95"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.0.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "firebird", "source": "cna", "vendor": "FirebirdSQL"}, "product": "firebird", "vendor": "firebirdsql"}], "analysis": {"en": {"generated_at": "2026-04-18T09:10:46.045869+00:00", "value": {"mitigation_remediation": ["Upgrade the Firebird database to version 5.0.4, 4.0.7, or 3.0.14 or later to apply the fixed crypt callback handler.", "If an upgrade cannot be performed immediately, restrict inbound access to the Firebird port with a firewall or network segmentation to block unauthenticated external traffic.", "Monitor server logs for abnormal op_crypt_key_callback traffic and set alerts for unexpected crashes to detect ongoing exploitation attempts."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service via Null Pointer Dereference"}, "threat_synthesis": {"affected_systems": "FirebirdSQL Firebird database software versions earlier than 5.0.4, 4.0.7, and 3.0.14 are affected. Versions 5.0.4, 4.0.7, and 3.0.14 or newer contain the fix.", "description_and_impact": "The vulnerability is a null pointer dereference in the port server crypt callback handler when the Firebird server receives an op_crypt_key_callback packet before authentication. This flaw allows an unauthenticated attacker who knows only the server's IP address and listening port to crash the database server, resulting in a denial of service. The weakness corresponds to CWE-476, a null pointer dereference fault that can be triggered without prior authentication.", "risk_and_exploitability": "The CVSS score is 8.2, indicating elevated severity. EPSS data is not available, so the likelihood of exploitation is uncertain, but the vulnerability is active and can be triggered remotely by anyone who can reach the Firebird port. The issue is not listed in the CISA KEV catalog, indicating it may not have had widespread exploitation yet, yet the potential for server outage is high given the lack of authentication requirement."}}}}, "created": "2026-04-17T20:30:15.693537+00:00", "updated": "2026-04-18T09:15:15.969045+00:00", "vendors": ["firebirdsql", "firebirdsql$PRODUCT$firebird"]}