Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2025-24975
Analyzed
More InfoOfficial Page
Source-security-advisories@github.com
View Known Exploited Vulnerability (KEV) details
Published At-15 Aug, 2025 | 15:15
Updated At-09 Oct, 2025 | 19:04

Firebird is a relational database. Prior to snapshot versions 4.0.6.3183, 5.0.2.1610, and 6.0.0.609, Firebird is vulnerable if ExtConnPoolSize is not set equal to 0. If connections stored in ExtConnPool are not verified for presence and suitability of the CryptCallback interface is used when created versus what is available could result in a segfault in the server process. Encrypted databases, accessed by execute statement on external, may be accessed later by an attachment missing a key to that database. In a case when execute statement are chained, segfault may happen. Additionally, the segfault may affect unencrypted databases. This issue has been patched in snapshot versions 4.0.6.3183, 5.0.2.1610, and 6.0.0.609 and point releases 4.0.6 and 5.0.2. A workaround for this issue involves setting ExtConnPoolSize equal to 0 in firebird.conf.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.17.1HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Primary3.18.8HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 7.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Type: Primary
Version: 3.1
Base score: 8.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CPE Matches

firebirdsql
firebirdsql
>>firebird>>Versions from 4.0.0(inclusive) to 4.0.6(exclusive)
cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*
firebirdsql
firebirdsql
>>firebird>>Versions from 5.0.0(inclusive) to 5.0.2(exclusive)
cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-754Secondarysecurity-advisories@github.com
CWE ID: CWE-754
Type: Secondary
Source: security-advisories@github.com
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://github.com/FirebirdSQL/firebird/commit/658abd20449f72097fbbce57e8e6ae42ff837fb6security-advisories@github.com
Patch
https://github.com/FirebirdSQL/firebird/issues/8429security-advisories@github.com
Issue Tracking
https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-fx9r-rj68-7p69security-advisories@github.com
Mitigation
Vendor Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-24975-detect-vulnerable-firebirdaf854a3a-2127-422b-91ae-364da2661108
Exploit
Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-24975-mitigate-firebird-vulnerabilityaf854a3a-2127-422b-91ae-364da2661108
Exploit
Third Party Advisory
Hyperlink: https://github.com/FirebirdSQL/firebird/commit/658abd20449f72097fbbce57e8e6ae42ff837fb6
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/FirebirdSQL/firebird/issues/8429
Source: security-advisories@github.com
Resource:
Issue Tracking
Hyperlink: https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-fx9r-rj68-7p69
Source: security-advisories@github.com
Resource:
Mitigation
Vendor Advisory
Hyperlink: https://www.vicarius.io/vsociety/posts/cve-2025-24975-detect-vulnerable-firebird
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Exploit
Third Party Advisory
Hyperlink: https://www.vicarius.io/vsociety/posts/cve-2025-24975-mitigate-firebird-vulnerability
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Exploit
Third Party Advisory
Change History
0Changes found

Details not found