Loading story…
Firebird disclosed two high-severity vulnerabilities affecting versions prior to 5.0.4, 4.0.7, and 3.0.14, including a path traversal and arbitrary file write issue tracked as CVE-2026-40342. The flaw resides in the external engine plugin loader, which improperly concatenates a user-controlled engine name into a filesystem path without filtering path separators or .. sequences. An authenticated user with CREATE FUNCTION privileges can abuse the bug to load an arbitrary shared library from disk, causing its initialization code to run immediately under the Firebird server's operating system account and resulting in remote code execution.
A second vulnerability, CVE-2026-28224, allows an unauthenticated attacker to crash a Firebird server by sending an op_crypt_key_callback packet before authentication, triggering a null pointer dereference because the port_server_crypt_callback handler is not initialized. The denial-of-service condition requires only network access to the server's IP address and port. Firebird addressed both issues in releases 5.0.4, 4.0.7, and 3.0.14, with advisories indicating the bugs carry high impact across availability and, in the case of CVE-2026-40342, confidentiality and integrity as well.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-40342 was disclosed as a Firebird vulnerability in which improper path handling in the external engine plugin loader lets an authenticated user with CREATE FUNCTION privileges load an arbitrary shared library. Successful exploitation can execute code as the Firebird server operating system account.
GitHub Security Advisories received and published CVE-2026-28224 on April 17, 2026, documenting a network-accessible null pointer dereference in Firebird's CryptCallback handling. The flaw allows an unauthenticated attacker to crash vulnerable Firebird servers.
Firebird released versions 5.0.4, 4.0.7, and 3.0.14 to address two security flaws: a path traversal and arbitrary file write issue leading to remote code execution, and a null pointer dereference in CryptCallback that can cause denial of service. The fixes apply to all affected versions prior to those releases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two vulnerabilities in PHP’s PDO database layer that affect the Firebird and PostgreSQL drivers, showing how low-level driver behavior can bypass application safeguards. The more severe issue, tracked as **`CVE-2026-25289`** in one report and previously referenced as **`CVE-2025-14179`**, affects `pdo_firebird` and can lead to SQL injection when NUL bytes inside quoted input are mishandled during SQL statement reconstruction, potentially dropping a closing quote and allowing attacker-controlled SQL to execute. A second flaw, **`CVE-2026-25290`** and previously referenced as **`CVE-2025-14180`**, affects PDO quoting with `pdo_pgsql` when emulated prepared statements are enabled. Invalid multibyte input can cause PostgreSQL escaping to return `NULL`, which PDO then dereferences, crashing PHP processes and creating a denial-of-service condition. The bugs were identified by PT SWARM researchers Aleksey Solovev and Nikita Sveshnikov, and patched PHP releases are available; organizations running older versions are exposed until they upgrade and should avoid unnecessary emulated prepares where possible.
Jul 7, 2026
Researchers disclosed an **integer wraparound/overflow** flaw in PostgreSQL’s *libpq* client library (tracked as **CVE-2025-12818**) that can be triggered via the `PQescapeInternal` code path used by `PQescapeLiteral` and `PQescapeIdentifier`. When a crafted input string of certain lengths includes quotes and/or backslashes, *libpq* can miscalculate the required buffer size, allocate too little memory, and then perform an **out-of-bounds write by hundreds of megabytes**, typically resulting in a **segmentation fault (DoS)** in the consuming application. F5’s product advisories state that PostgreSQL versions prior to **18.1, 17.7, 16.11, 15.15, 14.20, and 13.23** are affected by CVE-2025-12818, but report **no impact to F5 products** after evaluation. Separate F5 advisories published alongside this disclosure cover unrelated issues, including a PostgreSQL authorization/DoS issue in `CREATE STATISTICS` (**CVE-2025-12817**), a curl cross-protocol redirect token-leak issue (**CVE-2025-14524**), an Apache Solr *create core* input-validation/allowPaths bypass with potential NTLM hash disclosure on Windows (**CVE-2026-22444**), and a local privilege-escalation issue in the Intel 800 Series Ethernet Linux driver affecting certain F5 appliance lines (**CVE-2025-24325**).
Jun 29, 2026
Microsoft disclosed a broad set of vulnerabilities affecting the SQL Server ecosystem, including **remote code execution**, **elevation of privilege**, and **information disclosure** issues across **SQL Server Native Client**, **Microsoft ODBC Driver for SQL Server**, core **Microsoft SQL Server** components, and `Microsoft.SqlServer.XEvent.Configuration.dll`. The largest group of advisories covered SQL Server Native Client RCE flaws, including `CVE-2024-38255`, `CVE-2024-43459`, `CVE-2024-43462`, `CVE-2024-48993`, `CVE-2024-48995`, `CVE-2024-48996`, `CVE-2024-48997`, `CVE-2024-48998`, `CVE-2024-48999`, `CVE-2024-49000`, `CVE-2024-49004`, `CVE-2024-49005`, and `CVE-2024-49007`. Microsoft also listed `CVE-2024-49043` as an RCE flaw in `Microsoft.SqlServer.XEvent.Configuration.dll` and earlier ODBC driver RCE bugs `CVE-2023-36730` and `CVE-2023-36785`. Additional SQL Server issues included Native Scoring RCE vulnerabilities `CVE-2024-26186` and `CVE-2024-37338`, Native Scoring information disclosure flaws `CVE-2024-37342` and `CVE-2024-37966`, SQL Server elevation of privilege bugs `CVE-2024-37965`, `CVE-2024-37341`, `CVE-2024-37980`, and `CVE-2026-26116`, plus a general SQL Server information disclosure issue tracked as `CVE-2024-43474`. The disclosures show Microsoft addressing repeated attack surface in SQL Server connectivity layers and supporting components, underscoring the need for organizations running SQL Server clients, drivers, and related libraries to prioritize vendor updates across both server-side and workstation-deployed software.
Jun 29, 2026