FKIE_CVE-2025-70955

Vulnerability from fkie_nvd - Published: 2026-02-13 22:16 - Updated: 2026-02-18 17:52
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A Stack Overflow vulnerability was discovered in the TON Virtual Machine (TVM) before v2024.10. The vulnerability stems from the improper handling of vmstate and continuation jump instructions, which allow for continuous dynamic tail calls. An attacker can exploit this by crafting a smart contract with deeply nested jump logic. Even within permissible gas limits, this nested execution exhausts the host process's stack space, causing the validator node to crash. This results in a Denial of Service (DoS) for the TON blockchain network.
References
cve@mitre.orghttps://gist.github.com/Lucian-code233/25b0a13be569db9160340d9ecd2fdf0d
cve@mitre.orghttps://github.com/ton-blockchain/ton/commit/b5734d2e30b9c93cfdacb4ea37c9ebdf11ca5d49#diff-17eca9db515992a081522236bf9bad767fac171044f7c00c20bf740f4206b3de
cve@mitre.orghttps://github.com/ton-blockchain/ton/releases/tag/v2024.10#:~:text=krigga%20%28emulator%29%2C-%2CArayz%2C-%40%20TonBit%20%28LS%20security
cve@mitre.orghttps://mp.weixin.qq.com/s/wy2ea6udkNZzIsp1K2LEOQ
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Stack Overflow vulnerability was discovered in the TON Virtual Machine (TVM) before v2024.10. The vulnerability stems from the improper handling of vmstate and continuation jump instructions, which allow for continuous dynamic tail calls. An attacker can exploit this by crafting a smart contract with deeply nested jump logic. Even within permissible gas limits, this nested execution exhausts the host process\u0027s stack space, causing the validator node to crash. This results in a Denial of Service (DoS) for the TON blockchain network."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de desbordamiento de pila fue descubierta en la M\u00e1quina Virtual TON (TVM) antes de la v2024.10. La vulnerabilidad se origina en el manejo inadecuado de las instrucciones de salto de vmstate y de continuaci\u00f3n, que permiten llamadas de cola din\u00e1micas continuas. Un atacante puede explotar esto al crear un contrato inteligente con l\u00f3gica de salto profundamente anidada. Incluso dentro de los l\u00edmites de gas permitidos, esta ejecuci\u00f3n anidada agota el espacio de pila del proceso anfitri\u00f3n, provocando que el nodo validador falle. Esto provoca una denegaci\u00f3n de servicio (DoS) para la red de cadena de bloques TON."
    }
  ],
  "id": "CVE-2025-70955",
  "lastModified": "2026-02-18T17:52:44.520",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-13T22:16:10.170",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "https://gist.github.com/Lucian-code233/25b0a13be569db9160340d9ecd2fdf0d"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/ton-blockchain/ton/commit/b5734d2e30b9c93cfdacb4ea37c9ebdf11ca5d49#diff-17eca9db515992a081522236bf9bad767fac171044f7c00c20bf740f4206b3de"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/ton-blockchain/ton/releases/tag/v2024.10#:~:text=krigga%20%28emulator%29%2C-%2CArayz%2C-%40%20TonBit%20%28LS%20security"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://mp.weixin.qq.com/s/wy2ea6udkNZzIsp1K2LEOQ"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.