Tor EUVD-2026-28238

Exploitation requires the target Tor instance to have received or processed a BEGIN_DIR cell over a conflux leg, which occurs only when conflux is enabled (a newer feature not universally deployed). The attacker must either operate a relay that participates in the target's circuit or have network-layer access to intercept and inject Tor protocol cells. Default Tor configurations may not have conflux enabled, further limiting practical exploitation surface. The vulnerability is not remotely triggerable by passive network observation alone; active cell injection is mandatory. Exploitation is restricted to integrity violations within circuit state and does not allow confidentiality breaches (C:N in CVSS) or denial of service (A:N in CVSS).

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates network-accessible exploitation with high attack complexity and integrity impact only. The low CVSS score of 3.7 reflects limited practical harm. No EPSS score, KEV listing, or public proof-of-concept code is provided, suggesting this is not actively exploited in the wild. Attack complexity is rated 'High', meaning an attacker must perform non-trivial actions or craft specific conditions to trigger the vulnerability. The integrity impact is isolated (Scope Unchanged) and does not cascade to confidentiality or availability. Risk is further diminished because this attack requires either operating a malicious Tor relay or controlling network conditions to inject crafted BEGIN_DIR cells over conflux legs. For typical Tor users passively consuming circuits, the practical exploitation probability remains low. However, operators running Tor relays or bridges may warrant prompt patching to eliminate the window for directed attacks from relay operators or advanced network adversaries.

An attacker operating a malicious Tor relay or with network-level packet injection capability sends a crafted BEGIN_DIR cell to a target Tor client or relay over an established conflux leg, triggering improper state handling. Due to the high attack complexity, the attacker must either control a relay in the target's circuit path or achieve sophisticated network positioning (e.g., BGP hijacking, ISP-level MITM) to inject the malicious cell. If successful, the attacker may corrupt the circuit's internal state, potentially allowing subtle integrity violations in routing decisions or onion service operations.