PT-2026-33477 · Firebird+1 · Firebird+1

Published 2026-04-17 · Updated 2026-05-15 · CVE-2026-28212

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Firebird versions prior to 6.0.0 Firebird versions prior to 5.0.4 Firebird versions prior to 4.0.7 Firebird versions prior to 3.0.14

Description An unauthenticated attacker can cause a server crash by sending a crafted packet to the server port. This occurs when processing an 'op slice' network packet, where the server passes an unprepared structure containing a null pointer to the SDL info() function, leading to a null pointer dereference.

Recommendations Update to version 6.0.0 Update to version 5.0.4 Update to version 4.0.7 Update to version 3.0.14

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2026-05715

CVE-2026-28212

OESA-2026-2013

OESA-2026-2014

OESA-2026-2015

OESA-2026-2016

OESA-2026-2017

Affected Products

Firebird

Red Os

References · 34

• https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-9884-9qm3-hqch · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-28212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35215 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34232 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28212 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28224 · Security Note
• https://bdu.fstec.ru/vul/2026-05715 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-28214 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-65104 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40342 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33337 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2014 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-28212 · Vendor Advisory