Log in Start free

Vulnerability · Published Aug 15, 2025 · Assigned by GitHub_M

CVE-2025-54989Firebird XDR Message Parsing NULL Pointer Dereference Denial-of-Service Vulnerability

Medium 5.3

In plain English

A medium-severity null pointer dereference in firebird from FirebirdSQL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.7%top 47.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there is an XDR message parsing NULL pointer dereference denial-of-service vulnerability in Firebird. This specific flaw exists within the parsing of xdr message from client. It leads to NULL pointer dereference and DoS. This issue has been patched in versions 3.0.13, 4.0.6, and 5.0.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12firebird3.03.0.11.33637.ds4-2+deb12u1DEBIAN-CVE-2025-54989
Debian:13firebird3.03.0.12.ds7-13+deb13u1DEBIAN-CVE-2025-54989
Debian:14firebird3.03.0.13.ds7-1DEBIAN-CVE-2025-54989
Debian:13firebird4.04.0.5.3140.ds6-17+deb13u1DSA-5992-1
Debian:13firebird4.04.0.5.3140.ds6-17+deb13u1DEBIAN-CVE-2025-54989
Debian:14firebird4.04.0.6.3221.ds6-1DEBIAN-CVE-2025-54989
Ubuntu:22.04:LTSfirebird3.0no fix listedUBUNTU-CVE-2025-54989
Ubuntu:24.04:LTSfirebird3.0no fix listedUBUNTU-CVE-2025-54989
Ubuntu:25.10firebird3.0no fix listedUBUNTU-CVE-2025-54989
Ubuntu:26.04:LTSfirebird3.0no fix listedUBUNTU-CVE-2025-54989
Ubuntu:25.10firebird4.0no fix listedUBUNTU-CVE-2025-54989

Affected products (as reported)

VendorProductVersions
FirebirdSQL firebird < 3.0.13< 4.0.6< 5.0.3

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References