CVE-2026-77642

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77642", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-08-20T21:15:49.322Z", "datePublished": "2026-08-20T21:15:49.660Z", "dateUpdated": "2026-08-27T16:07:03.716Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Tor", "vendor": "torproject", "versions": [{"lessThan": "0.4.9.9", "status": "affected", "version": "0.2.8.2-alpha", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "tor before 0.4.9.9 was prone to an\u00a0out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-20T21:15:49.660Z"}, "references": [{"url": "https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.2.8.2-alpha", "versionEndExcluding": "0.4.9.9"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-27T16:03:17.038602Z", "id": "CVE-2026-77642", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T16:07:03.716Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77642", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-27T16:03:17.038602Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T16:03:23.055Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "torproject", "product": "Tor", "versions": [{"status": "affected", "version": "0.2.8.2-alpha", "lessThan": "0.4.9.9", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "tor before 0.4.9.9 was prone to an\u00a0out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "0.4.9.9", "versionStartIncluding": "0.2.8.2-alpha"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-20T21:15:49.660Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77642", "state": "PUBLISHED", "dateUpdated": "2026-08-27T16:07:03.716Z", "dateReserved": "2026-08-20T21:15:49.322Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-08-20T21:15:49.660Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Tor", "vendor": "torproject", "versions": [{"lessThan": "0.4.9.9", "status": "affected", "version": "0.2.8.2-alpha", "versionType": "custom"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*", "matchCriteriaId": "F8FF755D-D472-48A8-9F10-F64B625DD9C3", "versionEndExcluding": "0.4.9.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "tor before 0.4.9.9 was prone to an\u00a0out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019."}, {"lang": "es", "value": "tor antes de 0.4.9.9 era propenso a una escritura fuera de l\u00edmites al analizar un consenso o una firma separada con un tipo de resumen de firma inesperado. El impacto es menor para la mayor\u00eda de los roles de Tor, pero potencialmente mayor para las autoridades de directorio. Esto es TROVE-2026-019."}], "id": "CVE-2026-77642", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.7, "source": "cve@mitre.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77642", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-27T16:03:17.038602Z", "version": "2.0.3"}}]}, "published": "2026-08-20T22:18:06.070", "references": [{"source": "cve@mitre.org", "tags": ["Permissions Required", "Release Notes", "Vendor Advisory"], "url": "https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0.2.8.2-alpha,0.4.9.9)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Tor", "source": "cna", "vendor": "torproject"}, "product": "tor", "vendor": "torproject"}], "created": "2026-08-20T23:00:06.753584+00:00", "title": "Out\u2011Of\u2011Bounds Write During Consensus or Detached Signature Parsing in Tor", "updated": "2026-08-21T01:00:04.536787+00:00", "vendors": ["torproject", "torproject$PRODUCT$tor"]}