CVE-2026-28212 Firebird has potential server crash via null pointer dereference when processing op_slice packet

What is CVE-2026-28212?

CVE-2026-28212 is a high-severity vulnerability in FirebirdSQL firebird, published on 17 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Firebird is an open-source relational database management system. In versions prior to 6.0.0, 5.0.4, 4.0.7 and 3.0.14, when processing an op_slice network packet, the server passes an unprepared structure containing a null pointer to the SDL_info() function, resulting in a null pointer dereference and server crash. An unauthenticated attacker can trigger this by sending a crafted packet to the server port. This issue has been fixed in versions 6.0.0, 5.0.4, 4.0.7 and 3.0.14.

Weakness: CWE-476

Which versions are affected by CVE-2026-28212?

It affects 1 product.

Products include Firebirdsql Firebird.

How do I fix CVE-2026-28212?

Upgrade to a fixed version.

Is CVE-2026-28212 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-28212 exists.

Other vulnerabilities in FirebirdSQL firebird

• CVE-2026-40342 Firebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution Critical 10.0
• CVE-2008-0467 Memory corruption in n/a Critical 10.0
• CVE-2007-4992 Memory corruption in n/a Critical 10.0
• CVE-2007-5245 Memory corruption in n/a Critical 10.0
• CVE-2007-5246 Memory corruption in n/a Critical 10.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-28212, ECHO-5f5e-60d3-49c2, GHSA-9884-9qm3-hqch, UBUNTU-CVE-2026-28212.