# CVE-2026-77641: Tor use-after-free in CONFLUX_SWITCH cell handling

Source: https://junglewise.ai/threats/cve-2026-77641-tor-use-after-free-in-conflux-switch-cell-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77641 · Severity: medium · CVSS 6.5 · Published 2026-08-20

Tor is anonymity software used to route internet traffic securely. A flaw in Tor before version 0.4.9.9 allows the application to crash when sending a specific type of network cell fails. An attacker can trigger this crash, disrupting the relay's availability and potentially affecting users who depend on that relay for anonymous routing.

Technologies: [Torproject Tor](https://junglewise.ai/threats/technologies/tor). Vendors: [Torproject](https://junglewise.ai/threats/vendors/torproject).

## Quick answers

**Is CVE-2026-77641 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77641 being exploited in the wild.

**How severe is CVE-2026-77641?** Medium severity, with a CVSS score of 6.5, published 20 August 2026.

**Which products and versions are affected?** Tor Project Tor before 0.4.9.9.

**Is there a fix for CVE-2026-77641?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77641 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-77641?** Check whether you run Torproject Tor. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a use-after-free in Tor's conflux (multiplexed circuit) handling. When relay_send_command_from_edge() fails to send a CONFLUX_SWITCH cell, its return value is ignored by the caller. This causes the send failure—which internally calls circuit_mark_for_close() and removes the current leg via cfx_del_leg()—to go undetected. The caller then writes to the now-freed leg structure, resulting in a NULL write and crash. The attack requires network reachability to a Tor relay and can be triggered by sending a malformed CONFLUX_SWITCH cell or inducing a send failure condition.

## Affected products

- Tor Project Tor before 0.4.9.9

## Timeline

- 2026-08-20: disclosed

## References

- [https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog](https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog)

## Related threats

- [Tor out-of-bounds write in signature parsing](https://junglewise.ai/threats/cve-2026-77642-tor-out-of-bounds-write-in-signature-parsing)
- [Tor infinite loop in zlib/gzip decompression](https://junglewise.ai/threats/cve-2026-77640-tor-infinite-loop-in-zlib-gzip-decompression)
- [Tor compression bomb bypass in gzip/zlib stream handling](https://junglewise.ai/threats/cve-2026-77639-tor-compression-bomb-bypass-in-gzip-zlib-stream-handling)
- [Tor race condition in onion service rendezvous](https://junglewise.ai/threats/cve-2026-77638-tor-race-condition-in-onion-service-rendezvous)
- [Tor use-after-free in conflux object recovery](https://junglewise.ai/threats/cve-2026-77587-tor-use-after-free-in-conflux-object-recovery)