CVE-2025-65104
published 2026-04-17CVE-2025-65104: Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.18%
7.7th percentile
Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| firebirdsql | firebird | < 4.0.0 | 4.0.0 |
| firebirdsql | firebird | < 3.0.14 | 3.0.14 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Firebird: firebird3 client: FirebirdSQL/firebird: Firebird Client: Information leak when communicating with newer servers
vendor_redhat·2026-04-17·CVSS 7.5
CVE-2025-65104 [HIGH] CWE-130 Firebird: firebird3 client: FirebirdSQL/firebird: Firebird Client: Information leak when communicating with newer servers
Firebird: firebird3 client: FirebirdSQL/firebird: Firebird Client: Information leak when communicating with newer servers
Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.
A flaw was found in the Firebird client library. When an older version of the client library communicates with newer Firebird servers, it places incorrect data length values into XSQLDA fields. This vulnerability can lead to an information leak, potentially exposing sensitive data.
Statement: An Important severity information leak was found in the Firebird client library
VulDB
FirebirdSQL Firebird up to 3.x information disclosure (GHSA-mfpr-9886-xjhg)
vuldb·2026-04-17·CVSS 7.9
CVE-2025-65104 [HIGH] FirebirdSQL Firebird up to 3.x information disclosure (GHSA-mfpr-9886-xjhg)
A vulnerability was found in FirebirdSQL Firebird up to 3.x and classified as problematic. This affects an unknown part. Executing a manipulation can lead to information disclosure.
This vulnerability is handled as CVE-2025-65104. It is possible to launch the attack on the local host. There is not any exploit available.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-65104 firebird: Firebird Client: Information leak when communicating with newer servers [fedora-all]
bugzilla·2026-04-17·CVSS 7.9
CVE-2025-65104 [HIGH] CVE-2025-65104 firebird: Firebird Client: Information leak when communicating with newer servers [fedora-all]
CVE-2025-65104 firebird: Firebird Client: Information leak when communicating with newer servers [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2025-65104 firebird: Firebird Client: Information leak when communicating with newer servers [epel-all]
bugzilla·2026-04-17·CVSS 7.9
CVE-2025-65104 [HIGH] CVE-2025-65104 firebird: Firebird Client: Information leak when communicating with newer servers [epel-all]
CVE-2025-65104 firebird: Firebird Client: Information leak when communicating with newer servers [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2025-65104 Firebird: firebird3 client: FirebirdSQL/firebird: Firebird Client: Information leak when communicating with newer servers
bugzilla·2026-04-17·CVSS 7.9
CVE-2025-65104 [HIGH] CVE-2025-65104 Firebird: firebird3 client: FirebirdSQL/firebird: Firebird Client: Information leak when communicating with newer servers
CVE-2025-65104 Firebird: firebird3 client: FirebirdSQL/firebird: Firebird Client: Information leak when communicating with newer servers
Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.
2026-04-17
Published