FKIE_CVE-2025-70954

Vulnerability from fkie_nvd - Published: 2026-02-13 22:16 - Updated: 2026-02-18 17:52
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A Null Pointer Dereference vulnerability exists in the TON Virtual Machine (TVM) within the TON Blockchain before v2025.06. The issue is located in the execution logic of the INMSGPARAM instruction, where the program fails to validate if a specific pointer is null before accessing it. By sending a malicious transaction or smart contract, an attacker can trigger this null pointer dereference, causing the validator node process to crash (segmentation fault). This results in a Denial of Service (DoS) affecting the availability of the entire blockchain network.
References
cve@mitre.orghttps://gist.github.com/Lucian-code233/04940a264cab50732cc07fd991749226
cve@mitre.orghttps://github.com/ton-blockchain/ton/commit/9e5109d56bc4f2345a00b2271c3711103841b799
cve@mitre.orghttps://github.com/ton-blockchain/ton/releases/tag/v2025.06#:~:text=AArayz%2C%20wy666444%2C%20Robinlzw%2C%20Lucian-code233
cve@mitre.orghttps://mp.weixin.qq.com/s/IbRKrCKdMyIi-azkuqOOvg
134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.tonbit.xyz/blog/post/TonBit-Discovers-Critical-Vulnerability-on-TON-Virtual-Machine-for-the-Third-Time-Once-Again-Receiving-Official-Recognition-from-the-TON-Team.html
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Null Pointer Dereference vulnerability exists in the TON Virtual Machine (TVM) within the TON Blockchain before v2025.06. The issue is located in the execution logic of the INMSGPARAM instruction, where the program fails to validate if a specific pointer is null before accessing it. By sending a malicious transaction or smart contract, an attacker can trigger this null pointer dereference, causing the validator node process to crash (segmentation fault). This results in a Denial of Service (DoS) affecting the availability of the entire blockchain network."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de desreferencia de puntero nulo existe en la M\u00e1quina Virtual TON (TVM) dentro de la cadena de bloques TON antes de la v2025.06. El problema se encuentra en la l\u00f3gica de ejecuci\u00f3n de la instrucci\u00f3n INMSGPARAM, donde el programa no valida si un puntero espec\u00edfico es nulo antes de acceder a \u00e9l. Al enviar una transacci\u00f3n maliciosa o un contrato inteligente, un atacante puede desencadenar esta desreferencia de puntero nulo, provocando que el proceso del nodo validador falle (fallo de segmentaci\u00f3n). Esto resulta en una Denegaci\u00f3n de Servicio (DoS) que afecta la disponibilidad de toda la red de cadena de bloques."
    }
  ],
  "id": "CVE-2025-70954",
  "lastModified": "2026-02-18T17:52:44.520",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-13T22:16:10.047",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "https://gist.github.com/Lucian-code233/04940a264cab50732cc07fd991749226"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/ton-blockchain/ton/commit/9e5109d56bc4f2345a00b2271c3711103841b799"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/ton-blockchain/ton/releases/tag/v2025.06#:~:text=AArayz%2C%20wy666444%2C%20Robinlzw%2C%20Lucian-code233"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://mp.weixin.qq.com/s/IbRKrCKdMyIi-azkuqOOvg"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://www.tonbit.xyz/blog/post/TonBit-Discovers-Critical-Vulnerability-on-TON-Virtual-Machine-for-the-Third-Time-Once-Again-Receiving-Official-Recognition-from-the-TON-Team.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.