CVE-2026-77587: Use After Free
Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A malicious Tor exit node could trigger the flaw and crash an affected Tor client. Exploitation is network-based and requires no privileges or user interaction, but the stated attack complexity is high.
Which deployments are affected?
Tor versions before 0.4.9.11 are affected. The issue involves conflux recovery behavior when the last linked leg of a conflux set has already closed.
What is the impact of successful exploitation?
The described impact is a client crash, resulting in an availability denial of service. The provided severity vector indicates no confidentiality or integrity impact.
What should be done if an affected version is in use?
Upgrade Tor to 0.4.9.11 or later. The provided data does not specify an alternative configuration-based mitigation.