CVE-2025-1020 describes memory safety bugs in Firefox 134 and Thunderbird 134 that showed evidence of memory corruption. These bugs could have been exploited to run arbitrary code with sufficient effort. The vulnerabilities were fixed in Firefox 135 and Thunderbird 135. This issue is part of a broader set of memory safety fixes addressing use-after-free and other memory corruption bugs reported by the Mozilla Fuzzing Team and external researchers. The CVSS 3.1 score is 9.8, reflecting critical impact on confidentiality, integrity, and availability. Mozilla advisories MFSA2025-07 and MFSA2025-11 provide detailed information and confirm the fixes.

The vulnerability allows remote attackers to potentially execute arbitrary code on affected Firefox and Thunderbird versions due to memory corruption. This compromises confidentiality, integrity, and availability of the affected systems. The CVSS score of 9.8 indicates critical severity with network attack vector, no privileges or user interaction required. No known exploits in the wild have been reported at the time of publication.

Mozilla has released official fixes for this vulnerability in Firefox 135 and Thunderbird 135. Users and administrators should upgrade to these or later versions to remediate the issue. The vendor advisories MFSA2025-07 and MFSA2025-11 provide authoritative guidance and confirm that the vulnerability is fixed. Patch status is confirmed as fixed in these versions. No additional mitigation actions are required beyond applying the official updates.