What is the CVSS score of CVE-2025-54989?

CVE-2025-54989 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Firebird are affected by CVE-2025-54989?

Organizations using Firebird should be aware of moderate risk from CVE-2025-54989, a null pointer dereference vulnerability rated CVSS 5.3.. A patch is available.

How to fix or mitigate CVE-2025-54989?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Firebird CVE-2025-54989

MEDIUM

NULL Pointer Dereference (CWE-476)

2025-08-15 security-advisories@github.com

Denial Of Service Null Pointer Dereference Suse Firebird Firebirdsql

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SUSE

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:07 vuln.today

Patch released

Mar 28, 2026 - 19:07 nvd

Patch available

CVE Published

Aug 15, 2025 - 15:15 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there is an XDR message parsing NULL pointer dereference denial-of-service vulnerability in Firebird. This specific flaw exists within the parsing of xdr message from client. It leads to NULL pointer dereference and DoS. This issue has been patched in versions 3.0.13, 4.0.6, and 5.0.3.

AnalysisAI

Firebird is a relational database. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.

Technical ContextAI

This vulnerability is classified as NULL Pointer Dereference (CWE-476), which allows attackers to crash the application by dereferencing a null pointer. Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there is an XDR message parsing NULL pointer dereference denial-of-service vulnerability in Firebird. This specific flaw exists within the parsing of xdr message from client. It leads to NULL pointer dereference and DoS. This issue has been patched in versions 3.0.13, 4.0.6, and 5.0.3. Affected products include: Firebirdsql Firebird.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Check pointers before dereferencing. Use static analysis tools to detect null pointer paths.

More in Firebird

View all

CVE-2013-2492 MEDIUM This Month POC

6.8 Mar 15

Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514, and 2.5.1 through 2.5.3 before 26623, on Windo

CVE-2025-24975 HIGH This Week POC

7.1 Aug 15

Firebird is a relational database. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. Public ex

CVE-2016-1569 MEDIUM This Month POC

6.5 Jan 13

FireBird 2.5.5 allows remote authenticated users to cause a denial of service (daemon crash) by using service manager to

CVE-2026-40342 CRITICAL Act Now

9.9 Apr 17

Remote code execution in Firebird RDBMS versions prior to 5.0.4, 4.0.7, and 3.0.14 allows authenticated users with CREAT

CVE-2017-6369 HIGH This Week

8.8 Mar 24

Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticate

CVE-2014-9323 MEDIUM This Month POC

5.0 Dec 16

The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a de

CVE-2026-28224 HIGH This Week

8.2 Apr 17

Null pointer dereference in Firebird SQL server causes remote denial-of-service when unauthenticated attackers send malf

CVE-2026-27890 HIGH This Week

8.2 Apr 17

Remote denial-of-service in Firebird database server versions prior to 5.0.4, 4.0.7, and 3.0.14 allows unauthenticated n

CVE-2025-65104 HIGH This Week

7.9 Apr 17

Information disclosure in Firebird 3.x client library when connecting to Firebird 4+ servers allows local authenticated

CVE-2026-35215 HIGH This Week

7.5 Apr 17

Firebird database server crashes via crafted slice packet exploiting zero-length SDL descriptor validation flaw. Remote

CVE-2026-34232 HIGH This Week

7.5 Apr 17

Remote denial-of-service in Firebird Database Server versions prior to 5.0.4, 4.0.7, and 3.0.14 allows unauthenticated n

CVE-2026-33337 HIGH This Week

7.5 Apr 17

Buffer overflow in Firebird RDBMS allows remote unauthenticated attackers to crash database servers via malformed slice

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
openSUSE Leap 15.6	Fixed

CVE-2025-54989 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security	Fixed
SUSE Linux Enterprise Desktop 12	Fixed
SUSE Linux Enterprise Desktop 12 SP1	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
SUSE Linux Enterprise Server 12	Fixed
SUSE Linux Enterprise Server 12 SP1	Fixed
SUSE Linux Enterprise Server for SAP Applications 12	Fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP1	Fixed
SUSE Linux Enterprise Software Development Kit 12	Fixed
SUSE Linux Enterprise Software Development Kit 12 SP1	Fixed
openSUSE Leap 15.3	Fixed
openSUSE Leap 15.4	Fixed
openSUSE Leap 15.5	Fixed

Firebird CVE-2025-54989

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Firebird

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code