NULL Pointer Dereference in Tor Software by Tor Project

CVE-2026-44602

What is CVE-2026-44602?

The Tor software version prior to 0.4.9.7 is susceptible to a NULL pointer dereference when handling CERT cells received in a non-sequential order. This flaw can interfere with the application's ability to process these cells correctly, potentially leading to application crashes. Users of affected versions are advised to upgrade to the latest release to mitigate risks associated with this vulnerability and ensure the integrity of their connections.

References