Log in Start free

Vulnerability · Published Apr 17, 2026 · Assigned by GitHub_M

CVE-2025-65104Firebird: Information leak vulnerability in firebird3 client when used with newer server

High 7.9

In plain English

A high-severity information exposure in firebird from FirebirdSQL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.9High
Exploit odds (30 days)0.2%top 91.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12firebird3.0no fix listedDEBIAN-CVE-2025-65104
Debian:13firebird3.0no fix listedDEBIAN-CVE-2025-65104
Debian:14firebird3.03.0.14.ds7-1DEBIAN-CVE-2025-65104
Ubuntu:22.04:LTSfirebird3.0no fix listedUBUNTU-CVE-2025-65104
Ubuntu:24.04:LTSfirebird3.0no fix listedUBUNTU-CVE-2025-65104
Ubuntu:25.10firebird3.0no fix listedUBUNTU-CVE-2025-65104
Ubuntu:26.04:LTSfirebird3.0no fix listedUBUNTU-CVE-2025-65104
Ubuntu:26.10firebird3.0no fix listedUBUNTU-CVE-2025-65104
Ubuntu:25.10firebird4.0no fix listedUBUNTU-CVE-2025-65104
Ubuntu:26.10firebird4.0no fix listedUBUNTU-CVE-2025-65104

Affected products (as reported)

VendorProductVersions
FirebirdSQL firebird < 4.0.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

References