CVE-2025-54989

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-54989
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54989.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-54989
Aliases
  • GHSA-7qp6-hqxj-pjjp
Downstream
Related
Published
2025-08-15T15:04:19.097Z
Modified
2026-08-12T14:52:46.663528Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Firebird XDR Message Parsing NULL Pointer Dereference Denial-of-Service Vulnerability
Details

Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there is an XDR message parsing NULL pointer dereference denial-of-service vulnerability in Firebird. This specific flaw exists within the parsing of xdr message from client. It leads to NULL pointer dereference and DoS. This issue has been patched in versions 3.0.13, 4.0.6, and 5.0.3.

Database specific 
{
    "cwe_ids": [
        "CWE-476"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54989.json"
}
References

Affected packages

Git / github.com/firebirdsql/firebird

Affected ranges

Type
GIT
Repo
https://github.com/firebirdsql/firebird
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
afd8cb49cafdbd65d4eb1828a1244f96b8f54f62
Introduced
141bb5491d24cb363f03c5a0786a32f73a1faa5b
Fixed
ba9bbd01dcf278c18aaf08810389a423ec747119
Introduced
af1546f15fa871b313ebcc7df1fd2df3c396c616
Fixed
e98c36b17071c5ce228a5c069449c65b037799a0
Fixed
169da595f8693fc1a65a79c741724b1bc8db9f25
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.0.13"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.6"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.3"
        }
    ]
}

Affected versions

Other
R3_0_0
R3_0_1
R3_0_2
R3_0_3
R3_0_4
R3_0_5
R3_0_6
R3_0_7
T4_0_0_Beta1
T4_0_0_Beta2
T4_0_0_RC1
v3.*
v3.0.10
v3.0.11
v3.0.12
v3.0.8
v3.0.9
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v5.*
v5.0.0
v5.0.0-Beta1
v5.0.1
v5.0.2

Database specific

vanir_signatures_modified 
"2026-08-12T14:52:46Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54989.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "18808825195269127686926209100576434602",
                "277173124342533366112750273492753076447",
                "21662140014673703807227980439337995028"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-54989-479ddbc2",
        "source": "https://github.com/firebirdsql/firebird/commit/169da595f8693fc1a65a79c741724b1bc8db9f25",
        "target": {
            "file": "src/remote/protocol.cpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 332.0,
            "function_hash": "117535762452208583550419692663464789492"
        },
        "id": "CVE-2025-54989-bf9688cc",
        "source": "https://github.com/firebirdsql/firebird/commit/169da595f8693fc1a65a79c741724b1bc8db9f25",
        "target": {
            "function": "xdr_trrq_message",
            "file": "src/remote/protocol.cpp"
        }
    }
]