CVE-2026-77641: Medium severity The Tor Project Tor vulnerability
tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUXSWITCH cell fails. The return value of relaysendcommandfromedge() was ignored, so a send failure (which calls circuitmarkforclose() and removes the leg via cfxdelleg()) would go undetected, causing the caller to write to the now-freed current leg and resulting in a crash. This is TROVE-2026-017.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch TROVE-2026-017 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.4.9.9
Event History
Frequently Asked Questions
Which deployments are affected?
Tor versions before 0.4.9.9 are affected. Version 0.4.9.9 includes the referenced change log entry for this issue.
What must occur for exploitation to trigger the crash?
A CONFLUX_SWITCH cell send must fail. The failed send closes the circuit and removes its leg, but the caller continues and writes to that freed leg, causing a NULL write after free and crash.
Does exploitation require credentials or user interaction?
The supplied severity vector indicates the issue is network-reachable and requires neither privileges nor user interaction. It also rates attack complexity as high.
How can I determine whether an installation is affected?
Check the installed Tor version. Installations running a version earlier than 0.4.9.9 should be considered affected.