XDR Message Parsing NULL Pointer Dereference in Firebird Database
CVE-2025-54989

5.3MEDIUM

Key Information:

Vendor

Firebirdsql

Status
Firebird
Vendor
CVE Published:
15 August 2025

What is CVE-2025-54989?

Firebird, an established relational database, is susceptible to a NULL pointer dereference issue within its XDR message parsing process. This vulnerability can be triggered by malformed xdr messages sent from clients, leading to a denial-of-service condition. Users are advised to update to the patched versions 3.0.13, 4.0.6, or 5.0.3 to mitigate the risk. Comprehensive security measures should be employed to ensure the integrity and availability of database services.

Affected Version(s)

firebird < 3.0.13 < 3.0.13

firebird < 4.0.6 < 4.0.6

firebird < 5.0.3 < 5.0.3

References

https://github.com/FirebirdSQL/firebird/security/advisori...
x_refsource_CONFIRM
https://github.com/FirebirdSQL/firebird/issues/8554
x_refsource_MISC
https://github.com/FirebirdSQL/firebird/commit/169da595f8...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-54989 : XDR Message Parsing NULL Pointer Dereference in Firebird Database