What’s Vulnerable › Vulnerabilities

CVE-2020-6820: Mozilla Firefox And Thunderbird Use-After-Free Vulnerability

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2021-11-03
• EPSS: 7.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-24 · updated 2026-06-17
• Weakness: CWE-362

Description

Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

Affected products

• Mozilla Firefox: before 68.6.1; before 74.0.1 — fixed in 68.6.1, 74.0.1
• Mozilla Thunderbird: before 68.7.0 — fixed in 68.7.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 68.6.1, 74.0.1; Mozilla Thunderbird 68.7.0. Check the vendor advisory for mitigations.

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1626728
• https://usn.ubuntu.com/4335-1/
• https://www.mozilla.org/security/advisories/mfsa2020-11/
• https://www.mozilla.org/security/advisories/mfsa2020-14/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1626728
• https://usn.ubuntu.com/4335-1/
• https://www.mozilla.org/security/advisories/mfsa2020-11/
• https://www.mozilla.org/security/advisories/mfsa2020-14/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6820

Get alerted when CVE-2020-6820 or the next vulnerability affects your stack