Tor CVE-2026-44603

The target must be running Tor version 0.4.9.6 or earlier and must have the relay or exit port open to network connections (not running as a client-only instance, though clients also process incoming cells). The attacker must send the malformed BEGIN cell as part of an established Tor circuit; raw or unauthenticated cell transmission will not trigger the vulnerability because Tor requires a valid handshake and TLS layer before processing BEGIN cells. No special Tor configuration is required - default relay configurations are vulnerable. The attack is fundamentally limited by the requirement to establish a valid TLS connection and circuit prior to sending the malicious cell, which explains the high attack complexity rating in CVSS.

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates network-accessible remote code, but with high attack complexity, making practical exploitation difficult. The availability impact is limited (A:L), and no confidentiality or integrity impact is rated, contradicting the description's mention of 'information disclosure' - this discrepancy suggests either the CVSS underestimates the C impact or the description overstates it. No KEV status, EPSS score, or POC availability data is provided. The attack requires crafting a malformed BEGIN cell and sending it to a Tor relay, which requires network access to a relay and understanding of Tor's cell format. The high attack complexity combined with limited impact and lack of public exploitation evidence suggests this is a lower-priority issue than the CVSS number alone would indicate, but its network accessibility and lack of authentication requirements mean it is not trivial to ignore in production Tor deployments.

An attacker with network access to a Tor relay crafts a malformed BEGIN cell with an incorrect length field or structure. When the relay processes this cell during circuit handling, the parser reads one byte past the allocated buffer boundary. Depending on the memory layout at that time, this could leak a byte of memory containing sensitive data such as circuit keys or cause the relay process to crash, disrupting service. An attacker would need to know the target is running a vulnerable Tor version and establish a connection to its relay port (typically 6667 or custom), then send the malformed cell within a valid Tor handshake and circuit setup sequence.