CVE-2026-77641
tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls circuit_mark_for_close() and removes the leg via cfx_del_leg()) would go undetected, causing the caller to write to the now-freed current leg and resulting in a crash. This is TROVE-2026-017.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
- EPSS probability
- 0.19%
- CWE
- CWE-252
- Published
- 2026-08-20
- Last modified
- 2026-08-27
Affected products
- torproject Tor
Weakness type
Related vulnerabilities
- CVE-2026-86749 — snipe-it before 8.7.0 Data Loss via Failed Image Write
- CVE-2026-86739 — Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence
- CVE-2026-86141 — xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a...
- CVE-2026-19534 — undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
- CVE-2026-85649 — (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation...
- CVE-2026-14957 — FIPS mode assertion failure via malicious CERT payload
- CVE-2026-78699 — rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres
- CVE-2026-79772 — Nokogiri before 1.19.1 Unchecked Return Value canonicalize