PT-2025-33489 · Firebird · Firebird

Alexpeshkoff · Published 2025-08-15 · Updated 2025-10-09 · CVE-2025-24975

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Firebird versions prior to 4.0.6.3183 Firebird versions prior to 5.0.2.1610 Firebird versions prior to 6.0.0.609

Description: Firebird is a relational database. If the ExtConnPoolSize parameter is not set to 0, a server process segfault may occur due to improper verification of connections stored in the ExtConnPool and the CryptCallback interface. This can affect both encrypted and unencrypted databases, particularly when using chained execute statements. Accessing encrypted databases via an execute statement on an external connection, followed by an attachment missing the necessary key, may also occur.

Recommendations: Firebird versions prior to 4.0.6.3183: Update to version 4.0.6.3183 or later. Firebird versions prior to 5.0.2.1610: Update to version 5.0.2.1610 or later. Firebird versions prior to 6.0.0.609: Update to version 6.0.0.609 or later. As a workaround for all affected versions, set ExtConnPoolSize to 0 in the firebird.conf file.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2025-24975

DSA-5992-1

GHSA-FX9R-RJ68-7P69

Affected Products

Firebird

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24975.json · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2025-24975-mitigate-firebird-vulnerability · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2025-24975-detect-vulnerable-firebird · Exploit
• https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-fx9r-rj68-7p69 · Vendor Advisory
• https://github.com/FirebirdSQL/firebird/commit/658abd20449f72097fbbce57e8e6ae42ff837fb6 · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-24975 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-24975 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-24975 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-24975 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-24975 · Security Note
• https://osv.dev/vulnerability/DSA-5992-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-24975 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24975 · Security Note
• https://github.com/FirebirdSQL/firebird/issues/8429 · Note
• https://t.me/cveNotify/132732 · Telegram Post