Tor's relay cell handling contains a flaw that lets an adversary trigger an out-of-bounds read when an END, TRUNCATE, or TRUNCATED cell omits a reason in its payload. This omission causes an uninitialized memory read, which can expose sensitive data or lead to a program crash, and is identified as CWE‑684, a Resource Management weakness.

The vulnerability affects torproject:Tor versions prior to 0.4.9.7. Any Tor relay node that processes END, TRUNCATE, or TRUNCATED cells without a reason is vulnerable. The issue is specific to the Tor client/server product.

The CVSS score of 3.7 indicates a low‑severity vulnerability. With no EPSS data and no KEV listing, evidence of active exploitation is lacking, which suggests a limited risk. The flaw allows an out‑of‑bounds read that could expose data but does not provide code execution. The most likely attack vector is a attacker sending a crafted END, TRUNCATE, or TRUNCATED cell lacking a reason to a vulnerable relay over the data channel.