The CVSS 7.5 assigned to CVE-2026-77642 fundamentally misrepresents this vulnerability by collapsing a role-asymmetric threat into a flat severity number. The out-of-bounds write occurs during consensus and detached signature parsing in Tor's directory authority code, triggered by an unexpected signature digest type. This is not a generic buffer overflow in network input handling — it's a bounds-checking failure specifically in cryptographic metadata parsing, a pattern that emerges when protocol extensions introduce new digest types without updating validation logic.
The critical question determining actual severity is whether the OOB write triggers on consensus receipt (any node parsing a malformed consensus) or only during authority signature verification (requiring attacker influence over what the authority signs). If it's the former, this is a network-wide parsing vulnerability that 7.5 actually understates for relay operators who assumed consensus processing was peripheral to their role. If it's the latter, the attacker already needs near-authority-level positioning, and the score becomes a ceiling rather than a floor.
The "potentially major for directory authorities" language in the CVE is doing double duty: it's both a severity hedge and an implicit admission that this parsing code path hasn't received rigorous audit attention since it was written. The "unexpected digest type" trigger represents legacy code that persisted through version cycles because developers assumed those types would never reach this path — exactly the kind of forgotten validation logic that protocol extension pressure creates.
For operators: relay and client operators face minimal direct risk but should verify their Tor versions include the fix (0.4.9.9). Directory authority operators face the compound risk — both the local memory corruption possibility and the systemic exposure window between CVE publication and patch deployment across all nine authorities. If even one authority remains unpatched during that window, the consensus poisoning vector becomes live.
The actionable insight is architectural: Tor needs centralized input validation with hard failures on unexpected types, not per-case handling. This vulnerability will recur with the next protocol extension that adds a digest type unless the fix is structural rather than line-level.