CVE-2026-77642

Received Received - Intake

Out-of-Bounds Write in Tor Network Software

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: MITRE

Description

tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-77642

EUVD

EUVD-2026-63665

Affected Vendors & Products

Vendor	Product	Version / Range
tor_project	tor	to 0.4.9.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds write issue in the Tor software before version 0.4.9.9. It occurs when parsing a consensus or detached signature containing an unexpected signature digest type. The impact varies by Tor role, with directory authorities facing potentially major consequences while other roles experience minor effects.

Impact Analysis

If you run a Tor directory authority, this vulnerability could have major impacts, potentially compromising the integrity of the Tor network. For other users, the impact is minor, likely limited to potential instability or unexpected behavior in signature processing.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is specific to Tor software and its impact is limited to potential out-of-bounds write issues in consensus parsing. No evidence suggests direct implications for data protection or privacy regulations.

Mitigation Strategies

Upgrade Tor to version 0.4.9.9 or later to address the out-of-bounds write vulnerability. For directory authorities, this is critical due to potentially major impact.

Hi! I’m here to help you understand CVE-2026-77642. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70