CVE-2026-77641 - tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails

Back Back to CVE browser

HIGH

tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails

Published Aug 20, 2026

8.2

HIGH

CVSS 3.1

EPSS 0.35%

Description

tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls circuit_mark_for_close() and removes the leg via cfx_del_leg()) would go undetected, causing the caller to write to the now-freed current leg and resulting in a crash. This is TROVE-2026-017.

Affected products

Vendor Torproject Product Tor Default
unaffected
- Version
  0.4.8.1-alpha
  Status
  affected
  Constraints
  <0.4.9.9

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Torproject

Tor

unaffected

Version	Status	Constraints
0.4.8.1-alpha	affected	<0.4.9.9

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-252

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63658
Advisory
https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog
Release NotesVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63658		Advisory
https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog		Release NotesVendor Advisory