← Vulnerability feed

Vulnerability record · CVE-2026-44602 · published 7 May 2026

CVE-2026-44602: Torproject tor null pointer dereference vulnerability

Torproject · Tor

Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.

7.5 CVSS 3.1 High EPSS 0.60% · top 53.4% CWE-476 · NULL pointer dereference
7.5CVSS 3.1 base score
0.60%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://forum.torproject.org/c/news/tor-release-announcement/28 Release Notes
https://gitlab.torproject.org/tpo/core/tor/-/commit/df7d5174ef41814d806c8ede776e230cd30ac12b Patch
https://gitlab.torproject.org/tpo/core/tor/-/work_items/41240 Not Applicable
https://www.openwall.com/lists/oss-security/2026/05/06/8 Mailing ListRelease Notes

Track CVE-2026-44602 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2016-9079Firefox and Tor Browser SVG Animation use-after-freeA use-after-free flaw in SVG Animation affects Firefox before 50.0.2, Firefox ESR before 45.5.1, and Thunderbird before 45.5.1. Mozilla reports an ex…KEVEPSS 87%analysed9.3CVE-2026-77642Torproject tor out-of-bounds write vulnerabilitytor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact i…EPSS 0.35%9.1CVE-2026-44603Torproject tor vulnerabilityTor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007.EPSS 0.63%9.1CVE-2026-44597Torproject tor vulnerabilityTor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011.EPSS 0.63%9.0CVE-2026-77638Torproject tor race condition vulnerabilityTor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the o…EPSS 0.30%8.2CVE-2026-77641Torproject tor unchecked return value vulnerabilitytor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() …EPSS 0.35%8.2CVE-2026-77584Torproject tor vulnerabilityTor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a …EPSS 0.25%7.5CVE-2026-77587Torproject tor use after free vulnerabilityTor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last…EPSS 0.40%

Source: NIST National Vulnerability Database (record CVE-2026-44602), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.