Technical impact
A NULL write after free occurs in the tor relay when a CONFLUX_SWITCH cell fails to send. The failure is not detected because the function relay_send_command_from_edge ignores its return value, causing the relay to attempt to write to a leg that has already been freed. This overwrite leads to a crash, disrupting the relay and potentially any clients relying on it. The weakness is a classic example of unchecked return value misuse, identified as CWE-252.
Affected Systems
Tor versions prior to 0.4.9.9 are affected. The issue applies to all builds of the tor project that use the relay_send_command_from_edge code path. No specific patch version was listed beyond the fact that tor 0.4.9.9 fixed the bug.
Risk and Exploitability
The CVSS score of 6.5 indicates a moderate to high severity for disruption. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector requires an attacker able to send or influence a CONFLUX_SWITCH cell to a targeted relay; this could be achieved by a malicious network participant or by forcing a send failure. While the vulnerability does not expose confidentiality or integrity, it can enable a denial of service against the Tor network by crashing a relay.
