> CVE-2025-70956

« BACK_TO_HOME
PUBLISHED
2026-02-13 22:16
MODIFIED
2026-02-13 22:16
EPSS (Prob. Exploit)
0.54%
Top 55.3%
DATA SOURCES:
NVD 🔗 2026-02-13 FIRST EPSS 🔗 2026-10-25 OSV 🔗 2026-02-19

> DESCRIPTION

A State Pollution vulnerability was discovered in the TON Virtual Machine (TVM) before v2025.04. The issue exists in the RUNVM instruction logic (VmState::run_child_vm), which is responsible for initializing child virtual machines. The operation moves critical resources (specifically libraries and log) from the parent state to a new child state in a non-atomic manner. If an Out-of-Gas (OOG) exception occurs after resources are moved but before the state transition is finalized, the parent VM retains a corrupted state where these resources are emptied/invalid. Because RUNVM supports gas isolation, the parent VM continues execution with this corrupted state, leading to unexpected behavior or denial of service within the contract's context.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:
Unknown / Unknown
44 versions affected

> HISTORIQUE DES MODIFICATIONS

Première apparition
13/02/2026 22:16
Source: NVD
Total des modifications: 0 Dernière mise à jour: 8 months ago

> REFERENCES

https://gist.github.com/Lucian-code233/beab9d14683ed2bdf5543be430b91c70
https://github.com/ton-blockchain/ton/commit/1835d84602bbaaa1593270d7ab3bb0b4999...
https://github.com/ton-blockchain/ton/releases/tag/v2025.04#:~:text=Arayz%2C%20R...
https://mp.weixin.qq.com/s/ZD35baKUikefFdtNHZIC9g
« BACK_TO_HOME