Firebird CVE-2026-28224

No special conditions required for remote exploitation against network-accessible Firebird servers. The vulnerability is exploitable against default configurations on any Firebird version prior to 5.0.4, 4.0.7, or 3.0.14 that accept network connections on TCP port 3050 (standard) or any configured listener port. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication, no user interaction, and low complexity, meaning attackers need only network reachability to the Firebird service. Limiting factors include network-layer access controls such as firewall rules restricting source IPs, private network deployment without internet exposure, or embedded-mode installations with no network listener enabled. Servers behind properly configured firewalls allowing connections only from trusted application tiers are not exploitable by external attackers, significantly reducing practical risk for properly segmented database architectures.

Real-world risk is moderate-to-high for internet-exposed Firebird servers but lower for properly segmented internal deployments. The CVSS 8.2 score reflects the severe availability impact combined with network accessibility, though the absence of confidentiality impact and presence of only low integrity impact reduces data breach risk. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable remotely without authentication, making it attractive for opportunistic denial-of-service attacks or reconnaissance. However, no CISA KEV listing or public exploit code suggests limited real-world exploitation to date, likely because Firebird has smaller market share than enterprise databases like Oracle or PostgreSQL. The low attack complexity and unauthenticated vector mean exploitation could be automated in scanning tools. Organizations with internet-facing Firebird instances should prioritize patching immediately, while those with network-segmented databases can schedule updates within normal maintenance windows. The lack of confidentiality impact means this is purely a reliability issue, not a data exfiltration vector, which may lower priority versus RCE vulnerabilities in risk frameworks focused on data protection.

An external attacker scans the internet for exposed Firebird database servers on TCP port 3050 and identifies targets running vulnerable versions through banner grabbing or protocol fingerprinting. The attacker crafts a malformed op_crypt_key_callback packet and sends it to the server without completing authentication, triggering the null pointer dereference in the uninitialized port_server_crypt_callback handler and causing an immediate server crash. The attacker repeats this process to sustain denial-of-service, disrupting database availability for applications and users relying on the Firebird instance. No proof-of-concept code is publicly confirmed, though the straightforward nature of sending a specific packet type makes development trivial for attackers familiar with the Firebird wire protocol.