Tor releases before 0.4.9.7 contain a NULL pointer dereference when an out‑of‑order CERT cell is received, causing the application to crash. The flaw is classified as CWE‑476 and can only disrupt service availability for the affected node, with no gain of control or data exfiltration for an attacker.

The vulnerability affects the Tor software distributed by the Tor Project. All Tor versions older than 0.4.9.7 are impacted; newer releases contain the fix.

The CVSS score of 3.7 indicates low severity. With no EPSS score available and the issue not listed in the CISA KEV catalog, exploitation appears limited. The likely attack vector is inferred to involve an attacker who can inject an out‑of‑order CERT cell into the circuit, which would require local or compromised network control. Consequently, the risk remains moderate‑low for most deployments, though a malicious actor with network insertion capabilities could provoke a denial of service.