NULL pointer dereference in Firebirdsql Firebird
CVE-2025-54989
Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there is an XDR message parsing NULL pointer dereference denial-of-service vulnerability in Firebird. This specific flaw exists within the parsing of xdr messag…
EPSS: 0.003 (55.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Firebirdsql Firebird — versions < 3.0.13, < 4.0.6, < 5.0.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7qp6-hqxj-pjjp (x_refsource_CONFIRM)
- https://github.com/FirebirdSQL/firebird/issues/8554 (x_refsource_MISC)
- https://github.com/FirebirdSQL/firebird/commit/169da595f8693fc1a65a79c741724b1bc8db9f25 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-54989?
- CVE-2025-54989 is a medium-severity vulnerability in Firebirdsql Firebird, classified under NULL Pointer Dereference. CVSS score: 5.3/10. Published 2025-08-15.
- How severe is CVE-2025-54989?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2025-54989 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.