Firebird Null Pointer Dereference: Unauthenticated Remote Crash Risk

The National Vulnerability Database (NVD) has detailed CVE-2026-28212, a high-severity vulnerability (CVSS 7.5) in Firebird, an open-source relational database management system. This flaw, categorized as CWE-476 (Null Pointer Dereference), allows an unauthenticated attacker to crash the Firebird server remotely by sending a specially crafted network packet. The issue stems from the server passing an unprepared structure containing a null pointer to the SDL_info() function during the processing of an op_slice network packet.

This is a critical remote denial-of-service vector. An attacker doesn’t need any credentials or prior access to exploit this; simply reaching the Firebird server port is enough. This makes it an attractive target for quick, disruptive attacks. The National Vulnerability Database confirms that versions prior to 6.0.0, 5.0.4, 4.0.7, and 3.0.14 are affected.

Defenders must prioritize patching. The National Vulnerability Database states that this issue has been fixed in Firebird versions 6.0.0, 5.0.4, 4.0.7, and 3.0.14. If direct patching isn’t immediately feasible, consider network segmentation or strict firewall rules to limit access to Firebird server ports only from trusted internal systems.