CVE-2026-77642CWE-787

CVE-2026-77642

High · published August 21, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00353 · 27.8th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-08-21T02:18Z
Affected products (1)
ProductVersionsFixed in
torproject/tor< 0.4.9.90.4.9.9
References (1)
https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog · [email protected]
EPSS history
Timeline
  • 20 AUG 21:15Z
    tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type
    cvelistv5