Is CVE-2025-24975 actively exploited?

No active exploitation of CVE-2025-24975 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-24975 be exploited remotely?

Yes. CVE-2025-24975 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-24975?

CVE-2025-24975 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2025-24975

HIGH

CVE-2025-24975

CWE-754Published: August 15, 2025· Updated: Jun 17, 2026

8.8

CVSS v3.1

Official Description

Firebird is a relational database. Prior to snapshot versions 4.0.6.3183, 5.0.2.1610, and 6.0.0.609, Firebird is vulnerable if ExtConnPoolSize is not set equal to 0. If connections stored in ExtConnPool are not verified for presence and suitability of the CryptCallback interface is used when created versus what is available could result in a segfault in the server process. Encrypted databases, accessed by execute statement on external, may be accessed later by an attachment missing a key to that database. In a case when execute statement are chained, segfault may happen. Additionally, the segfault may affect unencrypted databases. This issue has been patched in snapshot versions 4.0.6.3183, 5.0.2.1610, and 6.0.0.609 and point releases 4.0.6 and 5.0.2. A workaround for this issue involves setting ExtConnPoolSize equal to 0 in firebird.conf.

NVD Source

Technical Analysis

CVE-2025-24975 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.