01 Record

CVE-2026-77641

tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls

MediumPUBLISHEDCNA: mitre

Base score6.5 CVSS v3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

View raw JSON CVE Program record

02 Description

tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls

03 Metadata

Published

2026-08-20 21:09Z1 DAY AGO

Last updated

2026-08-20 21:09Z1 DAY AGO

Reserved

2026-08-20

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Medium (CVSS 6.5)

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Weaknesses

CWE-252Unchecked Return ValueBase

SSVC decision

No CISA-ADP assessment

Data version

5.2

Document digest

2394874127e5bf435c2ec72cfbe95be7eff3322f0a1eecdfc49c2526572bf983

04 Affected products

VendorProductVersionsPlatforms

torprojectTor0.4.8.1-alpha to < 0.4.9.9—

05 References

gitlab.torproject.orghttps://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog