CVE-2025-65104 HIGH

CVE-2025-65104: Firebird: Information leak vulnerability in firebird3 client when used with newer server

Vendor Firebirdsql
Product firebird
Weakness CWE-200 · Info exposure
Published April 17, 2026
Last update April 17, 2026
View on NVD All CVEs

CVSS base score

7.9/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

What the vulnerability does

01Description

Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.

Key dates

02Disclosure timeline

April 17, 2026 CVE published
April 17, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-20331 MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an application CVE-2022-41876 ezplatform-graphql GraphQL queries can expose password hashes CVE-2026-33745 cpp-httplib Client Leaks Authentication Credentials to Untrusted Hosts on Cross-Origin HTTP Redirect CVE-2024-37924 WordPress WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin <= 1.0.1 - Sensitive Data Exposure vulnerability CVE-2020-8832 Ubuntu 18.04 Linux kernel i915 incomplete fix for CVE-2019-14615