CVE-2026-77642 is a high severity (CVSS 7.5) out-of-bounds write in Tor before 0.4.9.9, tracked as TROVE-2026-019. It is triggered when parsing a consensus or detached signature with an unexpected digest type. The impact is minor for most roles but potentially major for directory authorities.
What's affected
- Product: Tor (torproject).
- Affected: versions before 0.4.9.9.
- Fixed: 0.4.9.9 or later. The ChangeLog page would not load for me, so check it for details.
- Weakness: CWE-787, out-of-bounds write.
- CVSS 7.5 (high). Tor tracks it as TROVE-2026-019. Not listed in CISA KEV.
How to check if you're exposed
Check the Tor version wherever you run Tor.
tor --version
If you run a directory authority, treat this as a priority. Relays, clients and onion services are called minor impact in the record, but they should be upgraded on the normal schedule. Since 0.4.9.9 is older than the 0.4.9.11 release that fixes CVE-2026-77638, target 0.4.9.11 or later and cover both.
Write down what you find, with the owner, version and network exposure of each instance. After you patch, check again and record the fixed version, so the next advisory starts from a current inventory. You can also paste a dependency manifest into the free scan at gold.safeguard.sh/scan for any packaged components that sit alongside this product.
What to do now
- Find all Tor installs and their versions.
- Upgrade to 0.4.9.11 or later, which is newer than 0.4.9.9 and also covers the sibling Tor issue CVE-2026-77638.
- Directory authority operators should upgrade first and verify consensus signing still works.
- Update Tor Browser through its updater.
Why it matters
An out-of-bounds write happens when code writes outside the memory it should. Here the trigger is a signature digest type that the parser did not expect. The record says the impact varies by role, which fits a parser that every node runs but where authorities handle the most sensitive data.
When the vendor says the impact is minor for most and major for a few, make sure the few know. If you run critical infrastructure on Tor, you are one of them.
Quick check
What is TROVE-2026-019?
It is the Tor Project's tracking identifier for this issue, named in the record.
Sources
Last reviewed: 19 October 2026.
