The vulnerability is a null pointer dereference in the port server crypt callback handler when the Firebird server receives an op_crypt_key_callback packet before authentication. This flaw allows an unauthenticated attacker who knows only the server's IP address and listening port to crash the database server, resulting in a denial of service. The weakness corresponds to CWE-476, a null pointer dereference fault that can be triggered without prior authentication.

FirebirdSQL Firebird database software versions earlier than 5.0.4, 4.0.7, and 3.0.14 are affected. Versions 5.0.4, 4.0.7, and 3.0.14 or newer contain the fix.

The CVSS score is 8.2, indicating elevated severity. EPSS data is not available, so the likelihood of exploitation is uncertain, but the vulnerability is active and can be triggered remotely by anyone who can reach the Firebird port. The issue is not listed in the CISA KEV catalog, indicating it may not have had widespread exploitation yet, yet the potential for server outage is high given the lack of authentication requirement.