High severity · published Aug 15, 2025
CVE-2025-54989
Firebird XDR Message Parsing NULL Pointer Dereference Denial-of-Service Vulnerability
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there is an XDR message parsing NULL pointer dereference denial-of-service vulnerability in Firebird. This specific flaw exists within the parsing of xdr message from client. It leads to NULL pointer dereference and DoS. This issue has been patched in versions 3.0.13, 4.0.6, and 5.0.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
firebird · FirebirdSQL
< 3.0.13; < 4.0.6; < 5.0.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54989
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54989
Patch
https://github.com/FirebirdSQL/firebird/commit/169da595f8693fc1a65a79c741724b1bc8db9f25
Issue Tracking
https://github.com/FirebirdSQL/firebird/issues/8554
Third Party Advisory
https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7qp6-hqxj-pjjp
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/08/msg00021.html
More from firebird
9.9
CVE-2026-40342
Firebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution
8.8
CVE-2025-24975
Firebird Non-Authorized Access to Encrypted Database Using Execute Statement on External
8.8
CVE-2017-11509
An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL statement
8.8
CVE-2017-6369
Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticated users to execute code by using a 'system' entrypoint from…
8.2
CVE-2026-28224
Firebird Null Pointer Dereference via CryptCallback causes DOS