TI-2026-54111 Aliases CVE-2026-77641 GHSA-r3c6-fj5w-6f75

tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH…

LOW 36CWE-252Published 2026-08-20 · Updated 2026-08-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls circuit_mark_for_close() and removes the leg via cfx_del_leg()) would go undetected, causing the caller to write to the now-freed current leg and resulting in a crash. This is TROVE-2026-017.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00353 29th percentileScored 2026-11-07

Fix Fixed Tor (torproject): 0.4.9.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
torproject	Tor	0.4.8.1-alpha to before 0.4.9.9	0.4.9.9	Patch available	CNA

Tor Vendortorproject Affected 0.4.8.1-alpha to before 0.4.9.9 Fixed in 0.4.9.9 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:torproject:tor::::::::	before 0.4.9.9	Vulnerable	torproject

cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:* Versions before 0.4.9.9 Vulnerable ·torproject

Remediation

Fix · CNA Tor (torproject) Fixed in 0.4.9.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-20
torproject Tor 0.4.9.9
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2026-54112 Out-of-bounds write in torproject TorPriority MEDIUM 40
- TI-2026-54109 Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could…Priority LOW 30
- TI-2026-54110 tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip…Priority LOW 24
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-77641
2026-10-03 Alias added: GHSA-r3c6-fj5w-6f75

References

Advisory 1

https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog

TI-2016-07433 Use after free in Mozilla Firefox KEVCVSS 3.1HIGH 7.5
TI-2023-09419 The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4… CVSS 3.1MEDIUM 6.5
TI-2018-00448 Use after free in Tor CVSS 3.0HIGH 7.5
TI-2026-54108 Race condition in torproject Tor CVSS 3.1CRITICAL 9.0
TI-2026-54112 Out-of-bounds write in torproject Tor CVSS 3.1CRITICAL 9.3
TI-2026-32508 Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell… CVSS 3.1CRITICAL 9.1

See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences