CVE-2025-70955

A Stack Overflow vulnerability was discovered in the TON Virtual Machine (TVM) before v2024.10. The vulnerability stems from the improper handling of vmstate and continuation jump instructions, which allow for continuous dynamic tail calls. An attacker can exploit this by crafting a smart contract with deeply nested jump logic. Even within permissible gas limits, this nested execution exhausts the host process's stack space, causing the validator node to crash. This results in a Denial of Service (DoS) for the TON blockchain network.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/Lucian-code233/25b0a13be569db9160340d9ecd2fdf0d
https://github.com/ton-blockchain/ton/commit/b5734d2e30b9c93cfdacb4ea37c9ebdf11ca5d49#diff-17eca9db515992a081522236bf9bad767fac171044f7c00c20bf740f4206b3de
https://github.com/ton-blockchain/ton/releases/tag/v2024.10#:~:text=krigga%20%28emulator%29%2C-%2CArayz%2C-%40%20TonBit%20%28LS%20security
https://mp.weixin.qq.com/s/wy2ea6udkNZzIsp1K2LEOQ

Configurations

No configuration.

History

No history.

Information

Published : 2026-02-13 22:16

Updated : 2026-02-18 17:52

NVD link : CVE-2025-70955

Mitre link : CVE-2025-70955

CVE.ORG link : CVE-2025-70955

JSON object : View

Products Affected

No product.

CWE

CWE-674

Uncontrolled Recursion

{"id": "CVE-2025-70955", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2026-02-13T22:16:10.170", "references": [{"url": "https://gist.github.com/Lucian-code233/25b0a13be569db9160340d9ecd2fdf0d", "source": "cve@mitre.org"}, {"url": "https://github.com/ton-blockchain/ton/commit/b5734d2e30b9c93cfdacb4ea37c9ebdf11ca5d49#diff-17eca9db515992a081522236bf9bad767fac171044f7c00c20bf740f4206b3de", "source": "cve@mitre.org"}, {"url": "https://github.com/ton-blockchain/ton/releases/tag/v2024.10#:~:text=krigga%20%28emulator%29%2C-%2CArayz%2C-%40%20TonBit%20%28LS%20security", "source": "cve@mitre.org"}, {"url": "https://mp.weixin.qq.com/s/wy2ea6udkNZzIsp1K2LEOQ", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "A Stack Overflow vulnerability was discovered in the TON Virtual Machine (TVM) before v2024.10. The vulnerability stems from the improper handling of vmstate and continuation jump instructions, which allow for continuous dynamic tail calls. An attacker can exploit this by crafting a smart contract with deeply nested jump logic. Even within permissible gas limits, this nested execution exhausts the host process's stack space, causing the validator node to crash. This results in a Denial of Service (DoS) for the TON blockchain network."}, {"lang": "es", "value": "Una vulnerabilidad de desbordamiento de pila fue descubierta en la M\u00e1quina Virtual TON (TVM) antes de la v2024.10. La vulnerabilidad se origina en el manejo inadecuado de las instrucciones de salto de vmstate y de continuaci\u00f3n, que permiten llamadas de cola din\u00e1micas continuas. Un atacante puede explotar esto al crear un contrato inteligente con l\u00f3gica de salto profundamente anidada. Incluso dentro de los l\u00edmites de gas permitidos, esta ejecuci\u00f3n anidada agota el espacio de pila del proceso anfitri\u00f3n, provocando que el nodo validador falle. Esto provoca una denegaci\u00f3n de servicio (DoS) para la red de cadena de bloques TON."}], "lastModified": "2026-02-18T17:52:44.520", "sourceIdentifier": "cve@mitre.org"}