Tor before 0.4.9.7 has a flaw that allows a peer to attempt or accept a BEGIN_DIR command over a conflux leg. The vulnerability means a malicious node can send a BEGIN_DIR not normally allowed in that context, potentially leading to the vulnerable Tor instance parsing directory data it should not. The flaw is cataloged as CWE-669, indicating a permission or access control issue. The official description does not state any specific confidentiality, integrity, or availability consequences beyond the fact that BEGIN_DIR handling is performed improperly.

Any Tor installation with a version earlier than 0.4.9.7 is susceptible. Users running those releases expose their nodes to network traffic from other Tor peers and the public internet, which could contain malicious BEGIN_DIR attempts.

The CVSS score of 3.7 classifies this as a low‑severity problem. No EPSS score is available, and the vulnerability is not listed in CISA KEV. The likely attack vector is remote: an adversary must be able to communicate with the vulnerable node over the Tor network or provide traffic that can be interpreted as a conflux leg. Because the description lacks detail on exploitation conditions, the exact impact remains uncertain beyond the improper handling of BEGIN_DIR.