Tor CVE-2026-77638

Exploitation requires the attacker to be operating a Tor relay that gets selected as the rendezvous point for the specific client-to-onion-service connection being targeted, and then to win a narrow timing race during rendezvous negotiation ('just the right circumstances,' reflected in AC:H). No authentication or user interaction is needed (PR:N/UI:N), and it is exploitable over the network (AV:N), but the practical limiters are significant: the attacker cannot freely choose which client uses their relay as rendezvous point, the vulnerable code path is a race that does not reliably trigger, and only clients/services running Tor before 0.4.9.11 (from 0.3.5.3-alpha onward) are affected. This confines realistic exploitation to targeted deanonymization/impersonation against specific onion services rather than opportunistic mass attacks.

This carries a high CVSS 3.1 base score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) driven by network reach, no authentication, a scope change, and full CIA impact - but the AC:H (high attack complexity) reflects the core limiter: the flaw is a race condition (CWE-362) that only triggers 'in just the right circumstances,' and the attacker must be operating the relay that the client selects as its rendezvous point. Real-world signals sharply temper the paper severity: EPSS is only 0.17% (7th percentile), there is no CISA KEV listing and no public exploit code identified, indicating no observed or imminent widespread exploitation. The result is a genuine cryptographic/anonymity-integrity flaw in a security-critical product that warrants prompt patching for Tor operators and onion-service hosts, but is not a mass-exploitation emergency - its exploitation is probabilistic, position-dependent (attacker must control/be-chosen-as the rendezvous point), and race-timing-sensitive, pointing to targeted deanonymization/impersonation rather than opportunistic attacks. Note a labeling tension: the vendor vector asserts A:H, yet an onion-service impersonation/MITM is fundamentally a confidentiality+integrity compromise (read and tamper with traffic) and the availability justification is weak - treat A:H as generous.

An attacker runs a Tor relay and waits to be selected as the rendezvous point for a client attempting to reach a specific onion service; by winning a narrow timing race during rendezvous setup, the relay impersonates the onion service and interposes itself as a man-in-the-middle. The attacker can then present a fake service or read and tamper with the client's supposedly end-to-end-authenticated onion traffic. No public exploit code is known, and the high complexity plus required relay position make this a targeted rather than broad attack.