PT-2026-8036 · Unknown · Ton Virtual Machine

Published 2026-02-13 · Updated 2026-02-18 · CVE-2025-70955

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TON Virtual Machine versions prior to 2024.10

Description A Stack Overflow issue exists in the TON Virtual Machine (TVM). The root cause is the improper handling of vmstate and continuation jump instructions, leading to continuous dynamic tail calls. An attacker can exploit this by creating a smart contract with deeply nested jump logic. This nested execution exhausts the host process's stack space, even within permissible gas limits, resulting in a Denial of Service (DoS) for the TON blockchain network.

Recommendations Update to version 2024.10 or later.

Fix

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2025-70955

Affected Products

Ton Virtual Machine

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-70955 · Security Note
• https://osv.dev/vulnerability/CVE-2025-70955 · Vendor Advisory
• https://github.com/ton-blockchain/ton/releases/tag/v2024.10#:~:text=krigga%20%28emulator%29%2C-%2CArayz%2C-%40%20TonBit%20%28LS%20security · Note
• https://github.com/ton-blockchain/ton/commit/b5734d2e30b9c93cfdacb4ea37c9ebdf11ca5d49#diff-17eca9db515992a081522236bf9bad767fac171044f7c00c20bf740f4206b3de · Note
• https://t.me/cveNotify/152333 · Telegram Post
• https://twitter.com/CVEnew/status/2022437752734666895 · Twitter Post
• https://mp.weixin.qq.com/s/wy2ea6udkNZzIsp1K2LEOQ · Note
• https://gist.github.com/Lucian-code233/25b0a13be569db9160340d9ecd2fdf0d · Note
• https://twitter.com/VulmonFeeds/status/2022514818221998500 · Twitter Post
• https://t.me/CVEtracker/44666 · Telegram Post