Tor EUVD-2026-28231

Exploitation requires the attacker to be a participant in a Tor circuit (a relay or circuit endpoint) capable of sending an END, TRUNCATE, or TRUNCATED cell to the target, and to craft that cell so its payload lacks the trailing reason byte; parsing the absent reason causes the out-of-bounds read. Per CVSS AV:N/AC:L/PR:N/UI:N no authentication or user interaction is needed. Limiting factors: only Tor versions before 0.4.9.7 are affected, the attacker must be in a position to deliver the malformed control cell within a circuit, and the realistic impact is most consistent with a crash/DoS rather than confirmed remote data exfiltration. The vendor fix (upgrade to 0.4.9.7) is the stated remedy.

Signals conflict sharply here, so prioritization depends on operational context. The NVD CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N) frames this as a remotely reachable, low-complexity, no-privilege, no-interaction flaw - a party in a Tor circuit can send a malformed END/TRUNCATE/TRUNCATED cell with no reason byte and trigger an out-of-bounds read. However, every exploitation-likelihood signal points the other way: EPSS is 0.01% (1st percentile), SSVC records Exploitation: none, Automatable: no, and only partial Technical Impact, and the flaw is CWE-684 (out-of-bounds read), which for a networked daemon most plausibly yields a crash/DoS rather than reliable remote data theft - making the NVD C:H rating look optimistic for this memory-read class. CISA KEV does not list it and no working exploit is present in the input. The vuln.today 'act_now' label is driven by the high CVSS and patch availability, not by observed exploitation; treat this as a patch-promptly item (a core anonymity component with a clean fix) rather than an active-incident emergency. Note the tension explicitly: CVSS 9.1 and an 'act_now' label versus EPSS 0.01%, SSVC Exploitation:none, and partial technical impact - this is a high-CVSS, low-current-exploitation issue that warrants timely patching of an important network service, not crisis response.

An attacker positioned as a relay or endpoint within a Tor circuit sends an END, TRUNCATE, or TRUNCATED cell whose payload omits the expected reason byte; the vulnerable Tor instance reads past the end of the cell payload while parsing the absent reason. Given AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed, and the most likely realistic outcome is a crash/denial of service of the targeted Tor process, with possible disclosure of adjacent memory. No public exploit identified at time of analysis; the only linked commit is the upstream fix.