EUVD-2026-63665
GHSA-36cc-rhpv-jrxc
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H
Network-reachable parsing with no auth, but high complexity to craft malformed digest; S:C reflects potential cascade to Tor network consensus if directory authorities are targeted.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H
Lifecycle Timeline
3DescriptionCVE.org
tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019.
AnalysisAI
Out-of-bounds write in Tor's consensus and detached signature parser allows remote, unauthenticated network peers to trigger memory corruption by supplying a document with an unexpected signature digest type. All Tor releases before 0.4.9.9 are affected; impact is minor for relay and client nodes but potentially major for directory authorities, whose compromise could disrupt or undermine the integrity of the network-wide consensus. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires delivering a consensus document or detached signature containing an unexpected signature digest type to a Tor instance running version prior to 0.4.9.9 - this is the precise parser input that triggers the out-of-bounds write. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H) accurately reflects a memory corruption flaw that is network-reachable and requires no authentication, but whose high attack complexity (AC:H) meaningfully limits casual or automated exploitation - crafting a consensus or detached signature with a precisely malformed digest type field is a non-trivial prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker constructs a malformed Tor consensus document or detached signature in which the signature digest type field contains an unexpected value not handled by the parser. This crafted document is delivered over the network to a vulnerable Tor instance - most dangerously to a directory authority - causing the parser to write data out of bounds and corrupt adjacent memory, resulting in a process crash or potential memory state manipulation. … |
| Remediation | Upgrade Tor to version 0.4.9.9 or later, as documented in the official Tor Project ChangeLog at https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Tor directory authority nodes and restrict network access to explicitly whitelisted trusted peers; enable enhanced logging for consensus document validation failures. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discove
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-s
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. Rated high severity (CVSS 7.5), this vulnerability
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not th
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before att
Man-in-the-middle impersonation of onion services in Tor before 0.4.9.11 exploits a race condition in rendezvous point c
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden servic
Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the r
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the c
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today