What’s Vulnerable › Vulnerabilities

CVE-2020-26950

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 42.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-12-09 · updated 2026-06-17
• Weakness: CWE-416

Description

In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR < 78.4.1, and Thunderbird < 78.4.2.

Affected products

• Mozilla Firefox: before 82.0.3 — fixed in 82.0.3
• Mozilla Firefox ESR: before 78.4.1 — fixed in 78.4.1
• Mozilla Thunderbird: before 78.4.2 — fixed in 78.4.2

How to fix

Upgrade to a fixed version: Mozilla Firefox 82.0.3; Mozilla Firefox ESR 78.4.1; Mozilla Thunderbird 78.4.2. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/166175/Firefox-MCallGetProperty-Write-Side-Effects-Use-After-Free.html
• https://bugzilla.mozilla.org/show_bug.cgi?id=1675905
• https://www.mozilla.org/security/advisories/mfsa2020-49/
• http://packetstormsecurity.com/files/166175/Firefox-MCallGetProperty-Write-Side-Effects-Use-After-Free.html
• https://bugzilla.mozilla.org/show_bug.cgi?id=1675905
• https://www.mozilla.org/security/advisories/mfsa2020-49/

Get alerted when CVE-2020-26950 or the next vulnerability affects your stack