CVE-2026-44603 is a low severity read flaw (CVSS 3.7) in Tor before 0.4.9.7. A malformed BEGIN cell causes an out of bounds read of one byte, tracked as TROVE-2026-007. Update Tor to 0.4.9.7 or later, including every relay you run and any bundled copies.
What's affected
From the record and the Tor release announcement:
- Affected: Tor before 0.4.9.7.
- Fixed: 0.4.9.7.
The announcement lists the fix as an off by one out of bounds read if a malformed BEGIN cell is received, under relay and onion service fixes. It says the bug dates back to an old 0.2.4 series release.
How to check if you're exposed
Check the version:
tor --version
Relay operators should check every relay and every container image. Anyone who bundles Tor in an application should check the bundled version, not just the system one.
What to do now
- Update Tor to 0.4.9.7 or later.
- Update relays first, since the described receiving path is on relays and onion services.
- Read the release notes for the other fixes in the same release.
Why it matters
The class is CWE-193 (off by one error). The code checked a length with a comparison that was one byte too generous, so it read one byte past the buffer.
The record shows a low impact on availability only, and a high attack complexity. The record does not mark this CVE as KEV. A related issue in the same release is CVE-2026-44597.
Quick check
Which products are affected?
Tor before 0.4.9.7, including copies that applications bundle.
Sources
Last reviewed: 19 October 2026.
