CVE-2026-44603
Out-of-Bounds Read in Tor Network Client
Publication date: 2026-05-07
Last updated on: 2026-05-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| torproject | tor | to 0.4.9.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-193 | A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-44603 is an out-of-bounds read vulnerability in Tor versions before 0.4.9.7. It occurs due to a malformed BEGIN cell, which causes the software to read one byte beyond the intended memory boundary.
How can this vulnerability impact me? :
This vulnerability can lead to crashes or memory corruption in the Tor software. While it does not directly impact confidentiality or integrity, it may cause denial of service or potentially be exploited for security bypasses.
What immediate steps should I take to mitigate this vulnerability?
The Tor Project strongly recommends upgrading to Tor version 0.4.9.7 immediately to fix this vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
There is no information provided in the available context or resources about how CVE-2026-44603 affects compliance with common standards and regulations such as GDPR or HIPAA.