NULL Write After Free in Tor Before 0.4.9.9

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: MITRE

Description

tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls circuit_mark_for_close() and removes the leg via cfx_del_leg()) would go undetected, causing the caller to write to the now-freed current leg and resulting in a crash. This is TROVE-2026-017.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-77641

Affected Vendors & Products

Vendor	Product	Version / Range
tor_project	tor	to 0.4.9.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-252	The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL write after free issue in the Tor network software before version 0.4.9.9. It occurs when sending a CONFLUX_SWITCH cell fails. The function relay_send_command_from_edge() ignores the return value, so a failure goes undetected. This causes the caller to write to a now-freed memory location, leading to a crash.

Impact Analysis

This vulnerability could cause Tor software to crash, disrupting anonymity and network services. Users relying on Tor for privacy or accessing onion services may experience service interruptions or unexpected failures.

Mitigation Strategies

Upgrade Tor to version 0.4.9.9 or later to address the NULL write after free vulnerability in CONFLUX_SWITCH cell handling.

Hi! I’m here to help you understand CVE-2026-77641. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70