CVE-2026-77584

Tor before 0.4.9.10 fails to reject a CONFLUX_LINK cell on a circuit with attached streams; a malicious client sends RELAY_COMMAND_BEGIN first, orphaning an exit stream that leaves a dangling circuit back-pointer and triggers use-after-free when the circuit is freed. CVSS 3.1 scores 7.0 (HIGH). F...