CVE-2025-13020 is a use-after-free vulnerability (CWE-416) affecting the WebRTC Audio/Video component in Mozilla Firefox and Thunderbird. Use-after-free bugs occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption and arbitrary code execution. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5. The CVSS v3.1 base score is 8.8, with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The Mozilla advisories mfsa2025-87 and mfsa2025-88 confirm the fix and provide references to the bug report (Bug 1995686).

The vulnerability allows remote attackers to exploit a use-after-free condition in the WebRTC Audio/Video component, potentially leading to arbitrary code execution with high impact on confidentiality, integrity, and availability of the affected systems. However, no known exploits have been observed in the wild. Successful exploitation could compromise user data and system stability.

This vulnerability has been fixed by Mozilla in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on applying the official vendor patches. Patch status is confirmed by Mozilla advisories mfsa2025-87 and mfsa2025-88.