CVE-2025-70956
State Pollution Vulnerability in TON VM RUNVM Causes DoS
Publication date: 2026-02-13
Last updated on: 2026-02-17
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ton | virtual_machine | 2025.04 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1321 | The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a State Pollution issue in the TON Virtual Machine (TVM) before version 2025.04. It occurs in the RUNVM instruction logic, which initializes child virtual machines by moving critical resources such as libraries and logs from the parent VM state to the child VM state. The problem arises because this resource transfer is not atomic. If an Out-of-Gas (OOG) exception happens after the resources are moved but before the state transition is completed, the parent VM ends up with a corrupted state where these resources are missing or invalid.
As a result, the parent VM continues execution with this corrupted state due to gas isolation support in RUNVM, which can cause unexpected behavior or denial of service within the contract's context.
How can this vulnerability impact me? :
This vulnerability can impact you by causing unexpected behavior or denial of service within the context of smart contracts running on the TON Virtual Machine. Specifically, if the parent VM state becomes corrupted due to the non-atomic resource transfer and an Out-of-Gas exception, the contract may fail to execute correctly or may stop functioning altogether.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know