CVE-2026-77641 in Tor
Summary
by MITRE • 08/21/2026
tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls circuit_mark_for_close() and removes the leg via cfx_del_leg()) would go undetected, causing the caller to write to the now-freed current leg and resulting in a crash. This is TROVE-2026-017.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified as TROVE-2026-017 affects versions of Tor prior to 0.4.9.9, specifically targeting the handling of CONFLUX_SWITCH cells within the circuit management subsystem. This flaw represents a classic use-after-free condition that arises from improper error handling during network communication operations. The core technical issue lies in the function relay_send_command_from_edge(), which is responsible for transmitting commands along established Tor circuits. When this function attempts to send a CONFLUX_SWITCH cell, it may encounter conditions where transmission fails due to underlying connection issues or resource constraints. In such scenarios, the internal logic triggers circuit_mark_for_close() and subsequently cfx_del_leg(), effectively freeing the memory associated with the current circuit leg while the calling context remains unaware of this state change.
The critical failure stems from the caller ignoring the return value of relay_send_command_from_edge(). By not checking whether the send operation succeeded or failed, the application proceeds under the assumption that the network path is still valid and accessible. Consequently, subsequent code attempts to write data to the memory address representing the current leg. Since this memory has already been deallocated by cfx_del_leg(), the process performs a NULL write after free. This invalid memory access leads directly to an application crash, disrupting service availability for users relying on that specific circuit or node.
From a security impact perspective, while the immediate manifestation is a denial of service through segmentation faults or core dumps, use-after-free vulnerabilities are historically significant because they can often be exploited beyond simple crashes. Although this particular instance results in a crash due to the nature of the write operation, improper memory management patterns like this create opportunities for more sophisticated attacks if the freed memory is reallocated and overwritten with attacker-controlled data before being accessed again. The vulnerability aligns closely with CWE-416, which describes Use After Free errors where software continues to use pointers that point to deallocated memory.
In terms of threat modeling and detection frameworks, this flaw can be mapped to MITRE ATT&CK techniques related to resource exhaustion or denial of service via application crashes. It also reflects weaknesses in defensive coding practices categorized under CWE-252: Unchecked Return Value, where the software fails to verify that a function completed successfully before proceeding with dependent operations. The lack of robust error propagation allows transient network failures to escalate into persistent stability issues within the Tor relay or client process.
Mitigation for this vulnerability requires an immediate upgrade to Tor version 0.4.9.9 or later, where the issue has been resolved by ensuring that return values from critical send functions are properly validated and handled. Developers implementing similar communication layers should adopt strict error handling protocols, verifying every network operation's success before accessing associated resources. Additionally, employing memory safety tools such as AddressSanitizer during development can help detect these types of invalid access patterns early in the software lifecycle. For operational environments running older versions, monitoring for unexpected process terminations or core dumps on relays and clients may serve as an indicator of attempted exploitation or accidental triggering due to network instability.