CVE-2026-28224: Firebird Null Pointer Dereference via CryptCallback causes DOS
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an opcryptkeycallback packet without prior authentication, the portservercryptcallback handler is not initialized, resulting in a null pointer dereference and server crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28224?
CVE-2026-28224 is classified as a denial-of-service vulnerability affecting Firebird versions prior to 5.0.4, 4.0.7, and 3.0.14.
How do I fix CVE-2026-28224?
To remediate CVE-2026-28224, upgrade Firebird to version 5.0.4, 4.0.7, or 3.0.14 or later.
What causes the vulnerability CVE-2026-28224?
CVE-2026-28224 is caused by a null pointer dereference in the port_server_crypt_callback handler when receiving an op_crypt_key_callback packet without authentication.
Which versions of Firebird are affected by CVE-2026-28224?
Firebird versions prior to 5.0.4, 4.0.7, and 3.0.14 are affected by CVE-2026-28224.
What is the impact of exploiting CVE-2026-28224?
Exploiting CVE-2026-28224 can lead to a denial-of-service condition, making the server unresponsive.