CVE-2025-65104

Firebird: Information leak vulnerability in firebird3 client when used with newer server

High7.9EPSS 0.18%

Published: 17 Apr 2026
Updated: 17 Apr 2026
Reserved: 17 Nov 2025
Assigned by: GitHub_M

Description

Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.

Scores

CVSS scores of CVE-2025-65104, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	3.1	High7.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
NVDNVD · Analyzed	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (exploitation in 30 days): 0.18% · top 92% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.9.

Weakness

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)All about CWE-200 and its CVEs

Affected products

FirebirdSQL · firebird
- affected < 4.0.0

References (2)

https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-mfpr-9886-xjhg (opens in a new tab)x_refsource_CONFIRM
https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.0 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-65104](https://trackcve.app/badge/CVE-2025-65104.svg)](https://trackcve.app/cve/CVE-2025-65104)

Record last updated 17 Apr 2026, 18:25 UTC.