CVE-2026-44597 in Tor
Summary
by MITRE • 05/07/2026
Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/13/2026
The vulnerability in Tor versions prior to 0.4.9.7 represents a critical out-of-bounds read condition that emerges when processing specific control cell types including END TRUNCATE and TRUNCATED cells. This flaw occurs within the protocol handling layer where the software fails to properly validate the presence of required reason fields in cell payloads before attempting to access memory locations beyond the allocated buffer boundaries. The issue stems from insufficient input validation mechanisms that allow malformed control cells to trigger memory access violations during normal network operation.
The technical implementation of this vulnerability manifests when Tor's cell processing routine encounters control cells that should contain reason codes in their payload but instead receive cells with missing or malformed reason fields. This scenario creates a situation where the software attempts to read memory locations that fall outside the bounds of the allocated data structures, potentially leading to information disclosure or system instability. The flaw specifically affects the protocol parsing logic that handles connection termination and data flow control mechanisms within the Tor network's onion routing infrastructure.
From an operational perspective this vulnerability presents significant security implications for Tor network participants as it could enable attackers to craft malicious control cells that trigger memory corruption during normal network operations. The out-of-bounds read condition may allow for information leakage from memory segments that could contain sensitive cryptographic keys or network state information. Additionally the vulnerability could be exploited to cause denial of service conditions by forcing the Tor process to crash or behave unpredictably during cell processing operations.
This vulnerability maps directly to CWE-125 Out-of-bounds Read within the Common Weakness Enumeration catalog and aligns with ATT&CK technique T1059 Command and Scripting Interpreter where adversaries could potentially leverage such memory corruption issues to gain unauthorized access to network communications. The flaw also corresponds to ATT&CK technique T1566 Impairing Defenses where the vulnerability could be used to disrupt normal Tor network operations. The security implications extend beyond simple memory corruption as this type of vulnerability could potentially be chained with other exploits to create more sophisticated attack vectors within the Tor anonymity network.
The recommended mitigation strategy involves upgrading to Tor version 0.4.9.7 or later where the issue has been addressed through proper input validation of control cell payloads and implementation of bounds checking mechanisms. Network administrators should also consider implementing additional monitoring and logging of control cell processing activities to detect potential exploitation attempts. The fix typically involves adding explicit validation checks for reason field presence in control cells before any memory access operations occur, ensuring that all control cell payloads conform to expected formats and lengths. Organizations should also review their Tor network configurations to ensure proper handling of malformed control cells and implement appropriate rate limiting to prevent abuse of the vulnerability through automated attack vectors.