CVE-2026-77641CWE-252

CVE-2026-77641

Medium · published August 21, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls circuit_mark_for_close() and removes the leg via cfx_del_leg()) would go undetected, causing the caller to write to the now-freed current leg and resulting in a crash. This is TROVE-2026-017.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00353 · 27.8th percentile
Weakness
CWE-252 · Unchecked Return Value
Published
2026-08-21T01:17Z
Affected products (1)
ProductVersionsFixed in
torproject/tor< 0.4.9.90.4.9.9
References (1)
https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog · [email protected]
EPSS history
Timeline
  • 20 AUG 21:09Z
    tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails
    cvelistv5