CVE-2020-6820: Mozilla Firefox And Thunderbird Use-After-Free Vulnerability

Q: How do I fix CVE-2020-6820?

firefox: upgrade to 68.6.1, 74.0.1; thunderbird: upgrade to 68.7.0. Exact commands for each OS are on this page.

Q: Is CVE-2020-6820 being exploited?

Yes. CVE-2020-6820 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

Q: What does CVE-2020-6820 affect?

CVE-2020-6820 affects firefox, thunderbird. Severity is high (CVSS 8.1). Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Fi

Q: How urgent is CVE-2020-6820?

Priority 82/100. High severity; EPSS top 6%: very likely to be exploited; Exploited in the wild (CISA KEV); Remotely exploitable, no login, no user action

Patch now

HIGH 8.1EXPLOITEDREMOTEUPGRADEUPGRADE

CVE-2020-6820 is a high-severity flaw (CVSS 8.1) affecting firefox, thunderbird, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

Why this priority

High severity
EPSS top 6%: very likely to be exploited
Exploited in the wild (CISA KEV)
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	8.1 (High)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	None
User interaction	None
EPSS exploit chance	7.1% (top 6%)
CISA exploited list	Yes, fix due 2022-05-03
Weakness	CWE-362
Published	2020-04-24
Last modified	2026-06-17

Publisher (CNA): Mozilla Corporation · Vendor: mozilla

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2020-04-24 16:15 UTCPublished CVE record published
2021-11-03Exploited Added to the CISA Known Exploited Vulnerabilities list
2022-05-03Deadline CISA due date for US federal agencies to patch
2026-06-17 03:23 UTCUpdated Record last modified

mozilla firefox UPGRADE

Affected: < 68.6.1 · < 74.0.1

Fixed in: 68.6.1, 74.0.1

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy firefox || rpm -q firefox || firefox --version

2. UPGRADE to 68.6.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade firefox

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade firefox

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

mozilla thunderbird UPGRADE

Affected: < 68.7.0

Fixed in: 68.7.0

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy thunderbird || rpm -q thunderbird || thunderbird --version

2. UPGRADE to 68.7.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade thunderbird

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade thunderbird

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Fedora 46 · python-dtoc · FIXED · 0.1.0-1.fc46 · FEDORA-2026-e4734649a1 · source

sudo dnf upgrade --advisory=FEDORA-2026-e4734649a1

Fedora ELN · parallel · FIXED · 20261022-1.eln159 · FEDORA-2026-6d961c0286 · source

sudo dnf upgrade --advisory=FEDORA-2026-6d961c0286

Ubuntu 20.04 · firefox · FIXED · 75.0+build3-0ubuntu1

sudo apt update && sudo apt install --only-upgrade firefox dpkg --compare-versions "$(dpkg-query -W -f='${Version}' firefox)" ge "75.0+build3-0ubuntu1" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 20.04 · thunderbird · FIXED · 1:68.7.0+build1-0ubuntu1

sudo apt update && sudo apt install --only-upgrade thunderbird dpkg --compare-versions "$(dpkg-query -W -f='${Version}' thunderbird)" ge "1:68.7.0+build1-0ubuntu1" && echo PATCHED || echo STILL-VULNERABLE

Debian 12 · firefox-esr · FIXED · 68.6.1esr-1

sudo apt update && sudo apt install --only-upgrade firefox-esr dpkg --compare-versions "$(dpkg-query -W -f='${Version}' firefox-esr)" ge "68.6.1esr-1" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · firefox-esr · FIXED · 68.6.1esr-1

sudo apt update && sudo apt install --only-upgrade firefox-esr dpkg --compare-versions "$(dpkg-query -W -f='${Version}' firefox-esr)" ge "68.6.1esr-1" && echo PATCHED || echo STILL-VULNERABLE

Debian 12 · thunderbird · FIXED · 1:68.7.0-1

sudo apt update && sudo apt install --only-upgrade thunderbird dpkg --compare-versions "$(dpkg-query -W -f='${Version}' thunderbird)" ge "1:68.7.0-1" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · thunderbird · FIXED · 1:68.7.0-1

sudo apt update && sudo apt install --only-upgrade thunderbird dpkg --compare-versions "$(dpkg-query -W -f='${Version}' thunderbird)" ge "1:68.7.0-1" && echo PATCHED || echo STILL-VULNERABLE

RHEL 6 · firefox · FIXED · firefox-68.6.1-1.el6_10

sudo dnf upgrade --advisory=RHSA-2020:1339 rpm -q firefox

RHEL 6 · thunderbird · FIXED · thunderbird-68.7.0-1.el6_10

sudo dnf upgrade --advisory=RHSA-2020:1488 rpm -q thunderbird

RHEL 7 · firefox · FIXED · firefox-68.6.1-1.el7_8

sudo dnf upgrade --advisory=RHSA-2020:1338 rpm -q firefox

RHEL 7 · thunderbird · FIXED · thunderbird-68.7.0-1.el7_8

sudo dnf upgrade --advisory=RHSA-2020:1489 rpm -q thunderbird

RHEL 8 · firefox · FIXED · firefox-68.6.1-1.el8_1

sudo dnf upgrade --advisory=RHSA-2020:1341 rpm -q firefox

Alpine 3.20 · firefox-esr · FIXED · firefox-esr-68.6.1-r0

apk add --upgrade firefox-esr apk info -v firefox-esr

Alpine 3.20 · firefox · FIXED · firefox-74.0.1-r0

apk add --upgrade firefox apk info -v firefox

Alpine 3.20 · thunderbird · FIXED · thunderbird-68.7.0-r0

apk add --upgrade thunderbird apk info -v thunderbird

Alpine 3.21 · firefox-esr · FIXED · firefox-esr-68.6.1-r0

apk add --upgrade firefox-esr apk info -v firefox-esr

Amazon Linux 2 · see advisory · FIXED · ALAS2-2020-1429 · source

sudo yum update --advisory=ALAS2-2020-1429

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-6820?

firefox: upgrade to 68.6.1, 74.0.1; thunderbird: upgrade to 68.7.0. Exact commands for each OS are on this page.

Is CVE-2020-6820 being exploited?

Yes. CVE-2020-6820 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2020-6820 affect?

CVE-2020-6820 affects firefox, thunderbird. Severity is high (CVSS 8.1). Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Fi

How urgent is CVE-2020-6820?

Priority 82/100. High severity; EPSS top 6%: very likely to be exploited; Exploited in the wild (CISA KEV); Remotely exploitable, no login, no user action

Software pages

Mozilla Firefox vulnerabilities · Mozilla Thunderbird vulnerabilities

Related CVEs

CVE-2026-74990 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153
CVE-2026-74989 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox 153
CVE-2026-74988 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox ESR 153.0 and Firefox 153
CVE-2026-74987 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153
CVE-2026-74969 HIGH 8.8 UPGRADE UPGRADE Race condition, use-after-free in the Layout: Text and Fonts component

References

← Back to latest CVEs