CVE-2025-65104: Firebird: Information leak vulnerability in firebird3 client when used with newer server

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-17 · updated 2026-10-07
Weakness: CWE-200

Description

Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.

Affected products

FirebirdSQL firebird: before 3.0.14 — fixed in 3.0.14

How to fix

Upgrade to a fixed version: FirebirdSQL firebird 3.0.14. Check the vendor advisory for mitigations.

References

https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.0
https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-mfpr-9886-xjhg

Get alerted when CVE-2025-65104 or the next vulnerability affects your stack