CVE-2026-77587 in Tor
Summary
by MITRE • 08/21/2026
Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified as CVE-2024-39578, tracked under the identifier TROVE-2026-026, represents a critical memory management flaw within the Tor software suite prior to version 0.4.9.11. This issue specifically targets the conflux object mechanism used by Tor for circuit construction and path selection logic. The core technical defect is classified as a use-after-free vulnerability with potential double free characteristics. In the context of Tor's architecture, conflux objects are data structures that manage sets of linked legs or paths through the network. These objects maintain references to various components involved in establishing encrypted tunnels between clients and exit nodes. When a recovery leg attempts to revive an existing conflux set, the software fails to properly validate whether the last linked leg associated with that set has already been closed by another process or thread. This lack of state verification leads to the application attempting to access memory that has already been deallocated, triggering undefined behavior within the program's execution flow.
From a technical perspective, this flaw stems from improper synchronization and lifecycle management of internal data structures during circuit recovery operations. When a network event triggers a revocation or closure of a specific leg in a conflux set, the corresponding memory should be marked as invalid or removed from active references before any subsequent operation attempts to revive that same set. However, due to the race condition inherent in this logic, a malicious actor can manipulate the timing and sequence of these events. By carefully crafting network packets or triggering specific circuit states, an attacker can force the Tor client into a state where it tries to access freed memory. The double free aspect arises if the system attempts to deallocate the same block twice during error handling or cleanup routines following the initial invalid access, further corrupting heap metadata and increasing the likelihood of a crash or potential code execution depending on the specific allocator behavior and exploit conditions.
The operational impact of this vulnerability is primarily centered around denial of service against Tor clients. A malicious exit node, which acts as one endpoint in the circuit established by the client, can leverage this flaw to cause the Tor process to terminate unexpectedly. By sending specially crafted signals or triggering recovery scenarios that involve reviving closed conflux sets, an attacker can induce a crash on any connected client using vulnerable versions of Tor. While the primary observed impact is stability degradation through application crashes, use-after-free vulnerabilities are historically significant in security because they often provide opportunities for arbitrary code execution if memory corruption conditions align favorably with heap layout and allocator specifics. Although no public exploits demonstrating remote code execution have been widely documented for this specific instance, the potential severity remains high due to the fundamental nature of memory safety violations in C-based applications like Tor.
This vulnerability maps directly to CWE-416, which describes Use After Free errors, indicating that a pointer is used after it has been freed, leading to unpredictable behavior and security risks. Additionally, given the context of network interaction where an external party triggers the flaw via crafted inputs or state manipulation, it aligns with MITRE ATT&CK technique T1498, Network Denial of Service, specifically sub-technique 002 involving resource exhaustion through application crashes. The attack vector is classified as remote, requiring only network connectivity to a vulnerable Tor client instance without the need for prior authentication or local access.
Mitigation strategies focus on immediate software updates and defensive configuration practices. Users running Tor versions earlier than 0.4.9.11 must upgrade to version 0.4.9.11 or later, where this memory management logic has been corrected to properly check the state of linked legs before attempting revival operations. Developers should ensure that all conflux set revocations include rigorous checks for active references and proper synchronization mechanisms to prevent race conditions during circuit recovery. For organizations deploying Tor infrastructure, implementing automated patch management systems is essential to maintain compliance with security baselines. Furthermore, monitoring logs for unexpected process terminations or core dumps can help identify potential exploitation attempts in real-time, allowing for rapid incident response even if a specific exploit variant emerges before full deployment of the patched version across all nodes.