Tor processes a CONFLUX_LINK cell that appears on an existing circuit with attached streams, which normally should be rejected. A malicious client can first issue a RELAY_COMMAND_BEGIN to attach a stream and then send the offending CONFLUX_LINK. The circuit later frees a back‑pointer that is still referenced by the orphaned stream, triggering a use‑after‑free. This memory corruption can lead to a denial of service or arbitrary code execution, a classic CWE‑821 flaw.

Tor by the Tor Project, versions earlier than 0.4.9.10. Any Tor relay or client running 0.4.9.9 or older is susceptible; upgrades to 0.4.9.10 or newer eliminate the bug.

The CVSS score of 7 indicates high severity, but the EPSS score is not available and the flaw is not in the CISA KEV catalog. The likely attack vector is a remote client that can control the circuit; successful exploitation requires the attacker to send a RELAY_COMMAND_BEGIN followed by a CONFLUX_LINK, which is feasible over the normal Tor protocol. Given the lack of a public exploit, the immediate danger is moderate, but the potential impact is significant should an attacker trigger the UAF.