CVE-2025-1020
First published: Tue Feb 04 2025(Updated: )
Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Thunderbird | <135 | 135 |
| Mozilla Firefox | <135 | 135 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1939063%2C1942169
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-11/
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-07/
- https://www.mozilla.org/security/advisories/mfsa2025-07/
- https://www.mozilla.org/security/advisories/mfsa2025-11/
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the severity of CVE-2025-1020?
CVE-2025-1020 is considered a high-severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2025-1020?
To fix CVE-2025-1020, upgrade to Firefox or Thunderbird version 135 or later.
Which versions of Firefox are affected by CVE-2025-1020?
Firefox versions up to and including 134 are affected by CVE-2025-1020.
Which versions of Thunderbird are affected by CVE-2025-1020?
Thunderbird versions up to and including 134 are affected by CVE-2025-1020.
What types of vulnerabilities does CVE-2025-1020 include?
CVE-2025-1020 includes memory safety bugs that could potentially lead to memory corruption.
- collector/mozilla-advisory
- source/Mozilla
- agent/software-canonical-lookup
- agent/severity
- agent/softwarecombine
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/description
- collector/nvd-api
- source/NVD
- agent/source
- agent/last-modified-date
- agent/author
- agent/tags
- agent/event
- vendor/mozilla
- canonical/mozilla thunderbird
- canonical/mozilla firefox