CVE-2026-77641 is a medium severity (CVSS 6.5) crash in Tor before 0.4.9.9, tracked as TROVE-2026-017. When sending a conflux switch cell failed, the code ignored the error and wrote to freed memory. The fix is Tor 0.4.9.9, and later releases add more security fixes.
What's affected
Tor versions before 0.4.9.9. Fixed in 0.4.9.9, which the ChangeLog dates to 1 June 2026. The bug dates to 0.4.8.1-alpha according to the ChangeLog.
The record published this CVE on 20 August 2026, well after the release, so installations that were updated in the summer already have the fix. Those on long-lived distribution packages should confirm.
How to check if you're exposed
Run the binary and read the version.
tor --version
If Tor comes from your distribution, also ask the package manager for the installed version, since backports can carry fixes under older version numbers. Relay operators should check their relay's reported version in their monitoring. If you ship Tor inside another application, such as a browser bundle or an appliance, check the bundled tor version and the vendor's notes.
What to do now
- Upgrade Tor to 0.4.9.9 or later. The newer 0.4.9.10 and 0.4.9.11 releases fix further issues, so choose the newest available.
- Check embedded copies of Tor in applications and appliances.
- Restart the process after the upgrade.
- If you monitor relays, treat unexplained crashes on older builds as a reason to upgrade, not just restart.
Why it matters
The class is CWE-252, unchecked return value. The function that sends a command to the circuit reports failure through its return value. A failure also marks the circuit for close and removes the conflux leg. The caller did not look at the result, so it then wrote to a leg structure that no longer existed.
The ChangeLog describes the outcome as a crash. The vector in the record has high attack complexity and affects availability and a little integrity. It is a modest bug, but one that illustrates how often error handling is where memory safety fails. No exploitation is reported.
Quick check
What does an unchecked return value have to do with memory safety?
When a call fails and cleans up, the caller must stop using what was cleaned up. Skipping the check means it keeps using freed memory.
Do I need to act if I am on 0.4.9.11?
No, that release is newer than the fix.
Sources
Last reviewed: 18 October 2026.
