CVE-2025-1020 is a critical memory safety flaw, scored 9.8, in Firefox 134 and Thunderbird 134. Mozilla fixed it in Firefox 135 and Thunderbird 135. Update both to version 135 or later, and check any managed or packaged copies, since they often lag the vendor release.
What's affected
Mozilla's advisory MFSA 2025-07 says the memory safety bugs were present in Firefox 134 and Thunderbird 134, and were fixed in Firefox 135 and Thunderbird 135. The advisory was announced on 4 February 2025 and rates the impact as high. The reporter is listed as the Mozilla Fuzzing Team.
The advisory text is careful. It says some of these bugs showed evidence of memory corruption, and that Mozilla presumes that with enough effort some of them could have been exploited to run arbitrary code. That is a statement about possibility. It is not a report of attacks, and this CVE is not on the CISA Known Exploited Vulnerabilities list.
For Thunderbird, Mozilla's companion advisory MFSA 2025-11 adds a note: flaws inherited from the Firefox code base are generally not exploitable through email, because scripting is disabled when reading mail. It adds that they may still pose a risk in other features that display remote web content. Update Thunderbird as well.
How to check if you're exposed
Check the version in the application itself. In Firefox open the menu, choose Help, then About Firefox. In Thunderbird use Help, then About Thunderbird. Anything older than 135 in this release line is in scope.
From a terminal, these commands print the installed version on most systems:
firefox --version
thunderbird --version
On Debian or Ubuntu you can also run apt policy firefox thunderbird to see the installed and candidate versions. On macOS, the About Firefox window is the simplest check.
Fleet check: ask your endpoint tool for installed Firefox and Thunderbird versions, and look for machines that are still on 134. Also look for portable or user installed copies, which central tools often miss. Distribution packages for long term support builds may backport the fix without moving to version 135, so for those, read the distribution's security notice rather than comparing numbers.
What to do now
- Update Firefox to 135 or later on every desktop and server where it is installed.
- Update Thunderbird to 135 or later.
- Restart the applications. Browsers keep running the old code until they are restarted, and many users never close them.
- Check packaged, kiosk, container and virtual desktop images, and rebuild them with the updated version.
- For distribution packages, confirm the vendor's patched build in its own advisory.
- Keep automatic updates on, and for managed fleets set a short deadline for browser updates.
Why it matters
The flaw is listed under CWE-787 (out-of-bounds write). Memory safety bugs happen when code reads or writes outside the memory it should touch. In a browser, which parses untrusted content all day, that can corrupt memory in ways that an attacker might steer toward running code. Mozilla's own wording is that exploitation could be possible with enough effort.
The CVSS vector is network, low complexity, no privileges, no user interaction, with high impact on confidentiality, integrity and availability, which is how a 9.8 comes about. In practice, browser bugs often need chaining with other flaws, and Mozilla's advisory does not describe an attack. The sensible response is plain: browsers are installed on every machine, so patch within days, not weeks.
This kind of entry is also a good test of your inventory. If you cannot say how many machines run Firefox 134, you cannot say how many still need the update.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2025-1020 being exploited?
Mozilla's advisory does not report attacks, and the CVE is not on the CISA Known Exploited Vulnerabilities list. It says some of the bugs could potentially be exploited with enough effort.
Is Thunderbird at risk when reading email?
Mozilla says Firefox flaws are generally not exploitable through email in Thunderbird because scripting is disabled when reading mail, but other features that show remote web content may be at risk. Update anyway.
Sources
- Mozilla advisory MFSA 2025-07 (Firefox 135)
- Mozilla advisory MFSA 2025-11 (Thunderbird 135)
- NVD record for CVE-2025-1020
Last reviewed: 19 October 2026.
