CVE-2020-12426

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 78.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Jul 9, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-124278.8The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such aCVE-2020-124299.8Online Course Registration 2.0 has multiple SQL injections that would can lead to a complete database compromise and authentication bypass iCVE-2020-12437.8<p>A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate specific malicious data from CVE-2020-124306.5An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was fouCVE-2020-124316.6A Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16. Insecure permissions on the configuration filCVE-2020-124326.1The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, aCVE-2020-124385.4An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used agaiCVE-2020-124395.3Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain.CVE-2020-12447.1A denial of service vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations, aka 'ConnCVE-2020-124419.8Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the ‘HEATRemoteCVE-2020-124429.8Ivanti Avalanche 6.3 allows a SQL injection that is vaguely associated with the Apache HTTP Server, aka Bug 683250.CVE-2020-124439.8BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename
CVE-2020-12426: High severity, CVSS 8.8 | Vulnix