Torproject Tor vulnerabilities

CVE-2026-77642 Critical · 9.3 CWE-787 Aug 20, 2026

Out-of-bounds Write in Torproject Tor

tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019.

CVE-2026-77641 High · 8.2 CWE-252 Aug 20, 2026

Unchecked Return Value in Torproject Tor

tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls circuit_mark_for_close() and removes the leg via cfx_del_leg()) would go undetected, causing the caller to write to the now-freed current leg and resulting in a crash. This is TROVE-2026-017.

CVE-2026-77640 Medium · 5.3 CWE-1284 Aug 20, 2026

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated…

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z_STREAM_END, causing zlib to return Z_BUF_ERROR with no input remaining, which buf_add_compress() mistook for a full output buffer and retried forever. Fixed by returning TOR_COMPRESS_ERROR in that case so the caller can abort cleanly. This is TROVE-2026-021.

CVE-2026-77639 Medium · 5.3 CWE-420 Aug 20, 2026

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could…

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.

CVE-2026-77638 Critical · 9.0 CWE-362 Aug 20, 2026

Race Condition in Torproject Tor

Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach.

CVE-2026-77587 High · 7.5 CWE-416 Aug 20, 2026

Use After Free in Torproject Tor

Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026.

CVE-2026-77584 High · 8.2 CWE-821 Aug 20, 2026

Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which…

Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.

CVE-2026-44603 Critical · 9.1 CWE-193 May 7, 2026

Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka…

Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007.

CVE-2026-44602 High · 7.5 CWE-476 May 7, 2026

NULL Pointer Dereference in Torproject Tor

Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.

CVE-2026-44601 High · 7.5 CWE-837 May 7, 2026

Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client…

Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009.

CVE-2026-44600 Medium · 5.3 CWE-696 May 7, 2026

Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the…

Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010.

CVE-2026-44599 Medium · 5.3 CWE-669 May 7, 2026

Incorrect Resource Transfer Between Spheres in Torproject Tor

Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.

CVE-2026-44597 Critical · 9.1 CWE-684 May 6, 2026

Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED…

Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011.

CVE-2016-9079 High · 7.5 KEV Urgent · 79 Public exploit CWE-416 Jun 11, 2018

Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.