Firebird EUVD-2025-209528

Requires a mixed-version deployment: an application using the Firebird 3 (FB3) client library connecting to a Firebird 4.0-or-higher server. The bug does not occur when client and server are the same major version, so it is a version-mismatch/migration-window condition rather than a default-configuration flaw. Exploitation is limited to disclosure of whatever adjacent memory is exposed through the mis-sized XSQLDA field, and depends on an attacker being able to observe the leaked result data or influence the exchange; there is no code execution or integrity/availability impact. The fix is client-side (upgrade to the FB4+ client library), meaning server-side patching alone does not remediate affected clients.

Multiple signals converge on LOW real-world priority despite the vendor's 7.5 (HIGH) score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H) reads as a serious unauthenticated remote confidentiality flaw, but the corroborating exploitation signals all point downward: EPSS is 0.01% (2nd percentile), SSVC from CISA scores Exploitation=none, Automatable=no, and Technical Impact=partial (not total), there is no KEV listing, and no public exploit was identified. The SSVC 'partial' technical impact directly contradicts the vendor's C:H (total confidentiality) rating - an information leak from an incorrect XSQLDA data-length field is far more consistent with partial disclosure of adjacent memory than full confidentiality compromise, so C:H appears overstated. The vector's PR:N/AC:L also understates the real precondition: the flaw only manifests in a mixed-version deployment where a legacy FB3 client library talks to an FB4-or-higher server, which is an environmental/configuration dependency rather than a default-config attack. Net: this is a genuine but low-urgency data-handling bug, not an actively exploited high-risk issue; treat it as routine client-library hygiene, not an emergency.

In an environment where an application still links the legacy Firebird 3 (FB3) client library but connects to a Firebird 4.0+ server, the FB3 client writes incorrect data-length values into XSQLDA descriptor fields during result processing, causing more data than intended (e.g., uninitialized or adjacent buffer memory) to be exposed as query field content. An attacker positioned to observe that returned data - or a malicious/compromised FB4 server influencing the exchange - could harvest leaked memory contents. No public proof-of-concept exploit was identified at time of analysis.