The vulnerability arises because the Firebird 3 client library writes incorrect data length values into XSQLDA fields when a new Firebird 4 or higher server processes those requests. This flaw allows the client to read data that it should not be able to, creating a potential information leak. The flaw is classified as CWE‑200 and carries a CVSS score of 7.9, indicating a high likelihood of serious impact if exploited.

FirebirdSQL Firebird’s client library version 3 when used to communicate with a Firebird 4 or newer server. Any installation that mixes a FB3 client with a FB4 or higher server is susceptible; the impact spans the client environment and the data exposed through the database connection.

The CVSS score of 7.9 reflects a high severity, and the EPSS score of <1% indicates a very low exploitation probability, but the exploit is straightforward: any application that loads the FB3 client library and connects to a newer Firebird server can trigger the victim. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, but its exploitation does not require special conditions and could lead to unintended disclosure of sensitive data.