Firebird CVE-2026-28212

Remote network access to Firebird database port (default 3050/TCP) against vulnerable server versions. No authentication required - exploitation succeeds against default Firebird configurations with network listeners enabled. No user interaction needed. Limiting factors: Firebird must be configured to accept network connections (some embedded deployments use local IPC only). Many production deployments place databases behind firewalls or application tiers, significantly limiting exposure. Cloud-hosted or internet-facing Firebird instances represent highest risk profile. Attack succeeds equally against all supported platforms (Windows/Linux/Unix) as the vulnerability exists in cross-platform network protocol handling code.

Real-world risk is MODERATE despite high CVSS 7.5 score. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates trivial exploitation from the network without authentication, making this easily automatable for denial-of-service purposes. However, impact is strictly availability - no data theft, credential access, or code execution. SSVC technical impact would be classified as 'partial' (single system DoS). No CISA KEV listing and no public exploit code identified, suggesting exploitation has not been observed in the wild. EPSS score unavailable due to recent CVE assignment (2026 ID appears anomalous - likely 2025). Primary risk is to internet-exposed Firebird instances in production environments where database availability is critical. Many Firebird deployments are embedded or internal, reducing attack surface. Targeted attacks against known Firebird servers are feasible, but mass exploitation less likely than remote code execution vulnerabilities. Patch availability across all supported versions significantly reduces residual risk for maintained systems.

An attacker scans the internet for servers listening on port 3050/TCP and identifies a Firebird database instance through banner grabbing or service fingerprinting. The attacker crafts a malicious op_slice network packet with deliberately malformed structure initialization fields and sends it to the target server. The Firebird engine processes the packet, passes the unprepared structure to SDL_info(), and immediately crashes due to null pointer dereference, causing complete database unavailability until manual restart.