Description

Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-20T21:17:10.957Z",
  "pubdate": "2026-08-20T21:17:10.957Z",
  "executiveSummary": "A use-after-free vulnerability, designated as TROVE-2026-026, exists in Tor before version 0.4.9.11 within the handling of conflux objects. The flaw allows a malicious exit node to trigger a use-after-free condition and potential double free by manipulating recovery leg revival states when the final linked leg of a conflux set has already been closed. This memory corruption issue poses a significant risk to client availability, enabling an attacker to cause application crashes and denial of service conditions. Exploitation relies on network positioning where a compromised or malicious exit node can interact with affected Tor clients utilizing the conflux protocol feature. No authentication or elevated privileges are required by the attacker beyond controlling the adversarial exit node involved in the circuit construction and conflux management lifecycle. The primary operational impact is targeted client destabilization and forced termination of the Tor process.",
  "technicalDetails": "The vulnerability resides in the memory management logic handling conflux objects within Tor prior to version 0.4.9.11. The root cause stems from improper reference counting or state tracking when a recovery leg attempts to revive a conflux set whose last active linked leg has been previously closed. Under specific race conditions or state transitions orchestrated by network signaling, the object is prematurely freed while pointers to the structure may still be referenced or subsequently operated upon, leading to a use-after-free and potential double free condition. Exploitation occurs via the network vector when a client establishes circuits routed through a malicious exit node. The malicious exit node interacts with the conflux subsystem by transmitting specific control sequences or timing circuit closures and recoveries. Specifically, the attack flow initiates when the exit node interacts with the conflux protocol states, causing the last linked leg of a conflux set to close. Subsequently, the adversary triggers a recovery leg revival mechanism targeting the same conflux set. Because the internal state fails to safely handle the revival of a set whose foundational references were invalidated or disposed of, the underlying memory allocator encounters an invalid state during subsequent dereferencing or deallocation routines. This triggers a memory corruption fault resulting in an immediate crash of the Tor client process. The vulnerability affects the conflux component responsible for multi-path circuit aggregation and resilience. The condition can be triggered remotely over the network by any entity capable of acting as the exit node for the victim client's affected circuit. No local access, authentication credentials, or pre-existing privileges are necessary to induce the crash behavior, as the attack leverages standard protocol interactions between the client and the exit relay."
}