CVE-2025-65104
Information Leak in Firebird FB3 Client Library XSQLDA Fields
Publication date: 2026-04-17
Last updated on: 2026-04-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| firebirdsql | firebird | to 3.0.14 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Firebird open-source relational database management system, specifically in versions of the FB3 client library. The issue occurs because the FB3 client library places incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers. This incorrect data handling results in an information leak.
The vulnerability can be resolved by upgrading to the FB4 client or a higher version.
How can this vulnerability impact me? :
This vulnerability can lead to an information leak due to incorrect data length values being placed into XSQLDA fields during communication between the client and server. Such leaks may expose sensitive or confidential data unintentionally.
The CVSS v3.1 base score of 7.9 indicates a high severity, with impacts including low confidentiality loss, high integrity loss, and low availability loss.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability can be mitigated by upgrading the Firebird client library to version FB4 or higher.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Firebird client library versions prior to FB4 causes an information leak due to incorrect data length values in XSQLDA fields when communicating with FB4 or higher servers.
Such an information leak could potentially expose sensitive data, which may impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and health information.
However, specific impacts on compliance with these standards are not detailed in the provided information.