CVE-2026-77642: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-77642 is an out-of-bounds write vulnerability in the Tor anonymity network software that occurs when parsing a consensus or detached signature with an unexpected signature digest type. It is tracked internally as TROVE-2026-019 and affects Tor versions from 0.2.8.2-alpha up to (but not including) 0.4.9.9. The vulnerability was published on August 20, 2026, with a patch released in version 0.4.9.9. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is an out-of-bounds write (CWE-787) triggered during the parsing of Tor consensus documents or detached signatures when an unexpected signature digest type is encountered. An unauthenticated, remote attacker can exploit this by sending a specially crafted consensus or detached signature message to a vulnerable Tor node, causing the software to write data beyond the bounds of an allocated buffer. The attack requires high complexity (AC:H) but no privileges or user interaction, and the scope is changed (S:C), indicating potential impact beyond the vulnerable component itself. The Tor Project's ChangeLog for version 0.4.9.9 documents the fix (GitHub Advisory, Tor ChangeLog).

The primary impact is a high availability risk — a successful exploit can crash the Tor service or cause memory corruption. While the impact is described as minor for most Tor roles (relays, clients), it is potentially major for directory authorities, which are critical infrastructure components responsible for distributing consensus information to the entire Tor network. Disruption of directory authorities could degrade or destabilize the broader Tor network. Integrity impact is rated low, and there is no confidentiality impact (GitHub Advisory).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity (AC:H) further reduces the likelihood of opportunistic exploitation (GitHub Advisory).

The Tor Project has released version 0.4.9.9, which fixes this vulnerability. All operators running Tor versions from 0.2.8.2-alpha through 0.4.9.8 should upgrade immediately. Directory authority operators should treat this as a priority patch given the potentially major operational impact to their role. No configuration-based workarounds have been publicly documented (GitHub Advisory, Tor ChangeLog).

The vulnerability received brief coverage on social media, including a mention on Mastodon via The Hacker Wire shortly after disclosure. Automated vulnerability tracking services such as VulDB, CVEFeed, and INCIBE-CERT also indexed the advisory. No significant researcher commentary or vendor statements beyond the official Tor Project ChangeLog have been identified at this time.