Is CVE-2026-28214 actively exploited?

No active exploitation of CVE-2026-28214 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-28214 be exploited remotely?

Yes. CVE-2026-28214 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-28214?

CVE-2026-28214 has a CVSS score of 6.0 (MEDIUM).

HOME VULNERABILITIESCVE-2026-28214

MEDIUM

CVE-2026-28214

CWE-190Published: April 17, 2026· Updated: Apr 20, 2026

6.0

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:14.8th

Official Description

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when parsing a Wide type clumplet, causing an infinite loop. An authenticated user with INSERT privileges on any table can exploit this via a crafted Batch Parameter Block to cause a denial of service against the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

NVD Source

Technical Analysis

CVE-2026-28214 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.Low

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X