CVE-2025-54989: 
NixOS vulnerability analysis and mitigation

A NULL pointer dereference denial-of-service vulnerability (CVE-2025-54989) was discovered in Firebird, a relational database system. The vulnerability affects versions prior to 3.0.13, 4.0.6, and 5.0.3, specifically within the parsing of XDR messages from clients. The issue was disclosed on August 15, 2025, and patches were released to address this security flaw (GitHub Advisory).

The vulnerability exists in the XDR message parsing functionality where a NULL pointer dereference can occur during client message processing. The issue has been assigned a CVSS v3.1 base score of 7.5 (High) by NIST and 5.3 (Medium) by GitHub, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified as CWE-476 (NULL Pointer Dereference) (NVD).

When exploited, this vulnerability can lead to a denial-of-service condition through NULL pointer dereference, potentially causing the affected Firebird database service to crash or become unresponsive. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (GitHub Advisory).

The vulnerability has been patched in Firebird versions 3.0.13, 4.0.6, and 5.0.3. Users are advised to upgrade to these or later versions to mitigate the security risk. The fix involves additional validation checks in the XDR message parsing functionality (GitHub Commit).