CVE-2026-77587 is a medium severity (CVSS 5.9) use-after-free, and potential double free, in Tor before 0.4.9.11, tracked as TROVE-2026-026. A malicious exit node could use it to crash a client. The fix is Tor 0.4.9.11, so upgrade clients and relays.
What's affected
Tor versions before 0.4.9.11. Fixed in 0.4.9.11, which the ChangeLog dates to 25 June 2026. The ChangeLog places the introduction in 0.4.8.1-alpha.
Unlike the sibling conflux bug fixed in 0.4.9.10, the attacker here is a malicious exit node and the victim is a client. Anyone running a Tor client, including bundled clients in applications, is the audience for this one. The record rates availability impact only, with no confidentiality or integrity effect.
How to check if you're exposed
Run the binary and read the version.
tor --version
If Tor comes from your distribution, also ask the package manager for the installed version, since backports can carry fixes under older version numbers. Relay operators should check their relay's reported version in their monitoring. If you ship Tor inside another application, such as a browser bundle or an appliance, check the bundled tor version and the vendor's notes.
What to do now
- Upgrade Tor to 0.4.9.11 or later on clients, relays and embedded copies.
- If you ship an application that bundles Tor, update the bundle and check the tor version it reports.
- Restart after upgrade. A running process keeps the old code in memory.
- Track the Tor ChangeLog for later 0.4.9.x security releases.
Why it matters
This is CWE-416, use after free, with CWE-911, improper update of a reference count, as the second class. Conflux sets track several legs. A recovery leg can revive a set whose last linked leg has already been closed, and the code then used an object it had already released, with a possible second free on top.
For users the effect is a crash. For anonymity software a crashing client is more than an annoyance, because it can push users to reconnect or fall back to less careful behavior. The ChangeLog describes only a crash. No exploitation is reported and KEV is false.
Quick check
Can a normal website visitor trigger this?
The ChangeLog names a malicious exit as the trigger, so it takes control of an exit position in a circuit.
Does it leak data?
The record shows no confidentiality or integrity impact, only availability.
Sources
Last reviewed: 18 October 2026.
