PT-2026-8029 · Unknown · Ton Virtual Machine

Published 2026-02-13 · Updated 2026-02-14 · CVE-2025-70956

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TON Virtual Machine (TVM) versions prior to 2025.04

Description A state pollution issue exists in the TON Virtual Machine (TVM) due to non-atomic resource handling within the RUNVM instruction logic, specifically in the VmState::run child vm function. This function initializes child virtual machines by moving resources, including libraries and logs, from the parent state to the child state. If an Out-of-Gas (OOG) exception occurs during this process, after resources have been moved but before the state transition is complete, the parent VM can be left in a corrupted state. The parent VM continues execution with this corrupted state, potentially leading to unexpected behavior or denial of service within the contract's context.

Recommendations Update to version 2025.04 or later.

Fix

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-70956

Affected Products

Ton Virtual Machine

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-70956 · Security Note
• https://osv.dev/vulnerability/CVE-2025-70956 · Vendor Advisory
• https://github.com/ton-blockchain/ton/commit/1835d84602bbaaa1593270d7ab3bb0b499920416 · Note
• https://github.com/ton-blockchain/ton/releases/tag/v2025.04#:~:text=Arayz%2C%20Robinlzw%2C%20%40wy666444%20%40Lucian-code233 · Note
• https://twitter.com/VulmonFeeds/status/2022512258257945006 · Twitter Post
• https://gist.github.com/Lucian-code233/beab9d14683ed2bdf5543be430b91c70 · Note
• https://t.me/CVEtracker/44667 · Telegram Post
• https://twitter.com/transilienceai/status/2022514072802267387 · Twitter Post
• https://mp.weixin.qq.com/s/ZD35baKUikefFdtNHZIC9g · Note
• https://twitter.com/CVEnew/status/2022428990049587395 · Twitter Post