Firebird Client Flaw Leaks Data with Newer Servers

The National Vulnerability Database (NVD) has disclosed CVE-2025-65104, a high-severity information leak affecting Firebird, an open-source relational database management system. This vulnerability arises when older Firebird client libraries (FB3) communicate with newer Firebird servers (FB4 or higher). The FB3 client incorrectly populates XSQLDA fields with improper data length values, leading to an information leak.

This isn’t just a protocol quirk; it’s a critical data exposure. Attackers don’t need to be sophisticated. They simply need to be in a position to intercept traffic between an outdated client and a modern server. Given Firebird’s open-source nature, many organizations likely have mixed environments with legacy clients connecting to updated servers, creating a broad attack surface. The CVSS score of 7.9 (High) with a vector of AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L underscores the risk: a local attacker with low privileges can achieve high impact on confidentiality.

The fix is straightforward but requires immediate attention: upgrade all Firebird client libraries to FB4 or higher. This isn’t a ‘patch later’ situation. Any environment running this client-server combination is actively leaking data. Defenders must identify these older client instances and prioritize their upgrade path to mitigate this clear and present danger.