CVE-2026-77642

tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog	Permissions Required Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) tor antes de 0.4.9.9 era propenso a una escritura fuera de límites al analizar un consenso o una firma separada con un tipo de resumen de firma inesperado. El impacto es menor para la mayoría de los roles de Tor, pero potencialmente mayor para las autoridades de directorio. Esto es TROVE-2026-019.

Information

Published : 2026-08-20 22:18

Updated : 2026-10-18 20:10

NVD link : CVE-2026-77642

Mitre link : CVE-2026-77642

CVE.ORG link : CVE-2026-77642

JSON object : View

Products Affected

torproject

tor

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-77642", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77642", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-27T16:03:17.038602Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.7, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "torproject", "product": "Tor", "versions": [{"status": "affected", "version": "0.2.8.2-alpha", "lessThan": "0.4.9.9", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-20T22:18:06.070", "references": [{"url": "https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog", "tags": ["Permissions Required", "Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "tor before 0.4.9.9 was prone to an\u00a0out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019."}, {"lang": "es", "value": "tor antes de 0.4.9.9 era propenso a una escritura fuera de l\u00edmites al analizar un consenso o una firma separada con un tipo de resumen de firma inesperado. El impacto es menor para la mayor\u00eda de los roles de Tor, pero potencialmente mayor para las autoridades de directorio. Esto es TROVE-2026-019."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8FF755D-D472-48A8-9F10-F64B625DD9C3", "versionEndExcluding": "0.4.9.9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}