Tor before version 0.4.9.10 does not reject a CONFLUX_LINK cell arriving on a circuit that already has attached streams. A malicious client can send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, causing an exit stream to become orphaned. This results in a dangling circuit back-pointer and a use-after-free condition when the circuit is freed, classified under CWE-821 (Incorrect Synchronization). The affected version explicitly identified is 0.4.8.1-alpha. No vendor advisory or patch information is available at this time.

The vulnerability allows a malicious client to trigger a use-after-free condition in the Tor process, potentially leading to memory corruption. This could result in denial of service or other unintended behavior due to improper synchronization and memory management. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and low availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider upgrading to Tor versions 0.4.9.10 or later once available, as the description indicates the issue is fixed starting from that version. No other specific mitigations are provided.