CVE-2026-28224

Katalog CVE

CVSS 8.2 · High EPSS 0,72%

Kerentanan NULL Pointer Dereference pada firebirdsql firebird. Skor CVSS 3.1 8.2 (High) menurut github.com.

Deskripsi (NVD)

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an op_crypt_key_callback packet without prior authentication, the port_server_crypt_callback handler is not initialized, resulting in a null pointer dereference and server crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Rincian

Terbit di NVD

17 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,72% peluang dieksploitasi; lebih tinggi dari 52,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-xrcw-wpjx-pr95 exploit · advisory vendor
• https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14 release notes
• https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7 release notes
• https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4 release notes