CVE-2020-6820

HIGH KEV

Firefox < 74.0.1 and ESR < 68.6.1, Thunderbird < 68.7.0 - Use-After-Free via ReadableStream Race Condition

Title source: llm

Exploitation Summary

CVE-2020-6820 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021.

Description

Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

References (5)

Core 5

Core References

Vendor Advisory x_refsource_misc

https://www.mozilla.org/security/advisories/mfsa2020-14/

Vendor Advisory x_refsource_misc

https://www.mozilla.org/security/advisories/mfsa2020-11/

Issue Tracking, Permissions Required x_refsource_misc

https://bugzilla.mozilla.org/show_bug.cgi?id=1626728

Third Party Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/4335-1/

US Government Resource

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6820

Scores

CVSS v3 8.1

EPSS 0.0313

EPSS Percentile 87.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation active

Automatable no

Technical Impact total

Details

CISA KEV 2021-11-03

VulnCheck KEV 2020-04-01

InTheWild.io 2020-04-01

ENISA EUVD EUVD-2020-27964

CWE

CWE-362

Status published

Products (3)

mozilla/firefox < 68.6.1

mozilla/firefox < 74.0.1

mozilla/thunderbird < 68.7.0

Published Apr 24, 2020

KEV Added Nov 03, 2021

Tracked Since Feb 18, 2026