CVE-2026-77584

Name of the Vulnerable Software and Affected Versions Tor versions prior to 0.4.9.10

Description The software fails to reject a CONFLUX LINK cell when it arrives on a circuit that already has attached streams. A malicious client can send a RELAY COMMAND BEGIN before the CONFLUX LINK on the same circuit, attaching an exit stream. This process results in an orphan stream and a dangling circuit back-pointer, leading to a use-after-free (UAF) condition—a scenario where the program continues to use a pointer after the memory it points to has been freed—when the circuit is released.

Recommendations Update to version 0.4.9.10 or later.