CVE-2025-70954

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-70954
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-70954.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-70954
Published
2026-02-13T22:16:10.047Z
Modified
2026-02-20T06:33:36.397145Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A Null Pointer Dereference vulnerability exists in the TON Virtual Machine (TVM) within the TON Blockchain before v2025.06. The issue is located in the execution logic of the INMSGPARAM instruction, where the program fails to validate if a specific pointer is null before accessing it. By sending a malicious transaction or smart contract, an attacker can trigger this null pointer dereference, causing the validator node process to crash (segmentation fault). This results in a Denial of Service (DoS) affecting the availability of the entire blockchain network.

References

Affected packages

Git / github.com/ton-blockchain/ton

Affected ranges

Type
GIT
Repo
https://github.com/ton-blockchain/ton
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8f99af7843499fc65935047aaa9430bff1d981ce
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9e5109d56bc4f2345a00b2271c3711103841b799

Affected versions

func-0.*
func-0.0.99
func-0.1.0
func-0.2.0
func-0.3.0
func-0.4.0
func-0.4.1
func-0.4.2
func-0.4.3
func-0.4.4
func-0.4.5
func-0.4.6
Other
newton-end
newton-start
perfomance-test
tolk-0.*
tolk-0.10
tolk-0.12
tolk-0.12.0
tolk-0.13.0
tolk-0.8
tolk-0.9
tolk-0.99.0
tolk0.*
tolk0.7
v2022.*
v2022.05
v2022.06
v2022.08
v2022.09
v2022.10
v2022.12
v2023.*
v2023.01
v2023.03
v2023.04
v2023.05
v2023.06
v2023.10
v2023.11
v2023.12
v2024.*
v2024.01
v2024.02
v2024.03
v2024.04
v2024.06
v2024.08
v2024.09
v2024.10
v2024.12-1
v2024.12-alpha
v2025.*
v2025.02
v2025.03
v2025.04

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-70954.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "181386812233622416771839776786564561329",
            "length": 280.0
        },
        "source": "https://github.com/ton-blockchain/ton/commit/9e5109d56bc4f2345a00b2271c3711103841b799",
        "signature_type": "Function",
        "id": "CVE-2025-70954-c1d7b270",
        "target": {
            "file": "crypto/vm/tonops.cpp",
            "function": "exec_get_in_msg_param"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "140651565236459362203588608980848467804",
                "240584862446525851854795148106367625717",
                "116458325806165792873543443168658780572",
                "224268024356934766498539324127517105470"
            ]
        },
        "source": "https://github.com/ton-blockchain/ton/commit/9e5109d56bc4f2345a00b2271c3711103841b799",
        "signature_type": "Line",
        "id": "CVE-2025-70954-dd9a5c35",
        "target": {
            "file": "crypto/vm/tonops.cpp"
        }
    }
]