CVE-2026-77641

Undergoing Analysis Undergoing Analysis - In Progress

NULL Write After Free in Tor Before 0.4.9.9

Publication date: 2026-08-20

Last updated on: 2026-09-08

Assigner: MITRE

Description

tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls circuit_mark_for_close() and removes the leg via cfx_del_leg()) would go undetected, causing the caller to write to the now-freed current leg and resulting in a crash. This is TROVE-2026-017.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-09-08

Generated

2026-09-10

AI Q&A

2026-08-21

EPSS Evaluated

2026-09-07

NVD

CVE-2026-77641

Affected Vendors & Products

Vendor	Product	Version / Range
torproject	tor	to 0.4.9.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-252	The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL write after free issue in the Tor network software before version 0.4.9.9. It occurs when sending a CONFLUX_SWITCH cell fails. The function relay_send_command_from_edge() ignores the return value, so a failure goes undetected. This causes the caller to write to a now-freed memory location, leading to a crash.

Detection Guidance

This vulnerability is specific to the Tor network software and involves a NULL write after free in the handling of CONFLUX_SWITCH cells. Detection requires checking the Tor software version and monitoring for crashes or unexpected behavior during cell switching operations.

Impact Analysis

This vulnerability could cause Tor software to crash, disrupting anonymity and network services. Users relying on Tor for privacy or accessing onion services may experience service interruptions or unexpected failures.

Compliance Impact

This vulnerability causes a crash due to a NULL write after free in the Tor network software. It does not directly affect compliance with GDPR or HIPAA as it is a technical flaw in the Tor client rather than a data protection or privacy violation.

Mitigation Strategies

Upgrade Tor to version 0.4.9.9 or later to address the NULL write after free vulnerability in CONFLUX_SWITCH cell handling.

Hi! I’m here to help you understand CVE-2026-77641. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70