CVE-2026-44597 is a low severity out of bounds read (CVSS 3.7) in Tor before 0.4.9.7. An END, TRUNCATE or TRUNCATED cell that lacks a reason in its payload triggers the read, tracked as TROVE-2026-011. Update Tor to 0.4.9.7 or later, including bundled copies.
What's affected
From the record and the Tor release announcement:
- Affected: Tor before 0.4.9.7.
- Fixed: 0.4.9.7.
The release that fixes this is a security release. The change log lists several other fixes, so it is a good reason to update relays and clients together. The record gives a high attack complexity and a low availability impact only.
How to check if you're exposed
Check the installed version:
tor --version
Package managers show it too, for example apt policy tor or brew info tor. Relay operators should check every relay they run, and anyone who bundles Tor in an application should check the bundled copy.
What to do now
- Update Tor to 0.4.9.7 or later.
- Update bundled copies, such as those inside browsers or other applications.
- Read the release notes for the other fixes in the same release.
Why it matters
The record lists CWE-684 (incorrect provision of specified functionality). The code expected a reason byte in these cells and read it without confirming it was there, so it read past the end of the data.
The impact in the record is limited to availability, and the score is low. The Tor release notes say the bug was found by an outside reporter. The record does not mark this CVE as KEV. A sibling issue, CVE-2026-44603, is fixed in the same release.
Quick check
Is this urgent?
The score is low. Still, relays are public network services, so update them with the rest of the release.
Sources
Last reviewed: 19 October 2026.
