CVE-2025-70954

A Null Pointer Dereference vulnerability exists in the TON Virtual Machine (TVM) within the TON Blockchain before v2025.06. The issue is located in the execution logic of the INMSGPARAM instruction, where the program fails to validate if a specific pointer is null before accessing it. By sending a malicious transaction or smart contract, an attacker can trigger this null pointer dereference, causing the validator node process to crash (segmentation fault). This results in a Denial of Service (DoS) affecting the availability of the entire blockchain network.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/Lucian-code233/04940a264cab50732cc07fd991749226
https://github.com/ton-blockchain/ton/commit/9e5109d56bc4f2345a00b2271c3711103841b799
https://github.com/ton-blockchain/ton/releases/tag/v2025.06#:~:text=AArayz%2C%20wy666444%2C%20Robinlzw%2C%20Lucian-code233
https://mp.weixin.qq.com/s/IbRKrCKdMyIi-azkuqOOvg
https://www.tonbit.xyz/blog/post/TonBit-Discovers-Critical-Vulnerability-on-TON-Virtual-Machine-for-the-Third-Time-Once-Again-Receiving-Official-Recognition-from-the-TON-Team.html

Configurations

No configuration.

History

No history.

Information

Published : 2026-02-13 22:16

Updated : 2026-06-17 10:03

NVD link : CVE-2025-70954

Mitre link : CVE-2025-70954

CVE.ORG link : CVE-2025-70954

JSON object : View

Products Affected

No product.

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2025-70954", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-70954", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T18:28:54.214129Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-02-13T22:16:10.047", "references": [{"url": "https://gist.github.com/Lucian-code233/04940a264cab50732cc07fd991749226", "source": "cve@mitre.org"}, {"url": "https://github.com/ton-blockchain/ton/commit/9e5109d56bc4f2345a00b2271c3711103841b799", "source": "cve@mitre.org"}, {"url": "https://github.com/ton-blockchain/ton/releases/tag/v2025.06#:~:text=AArayz%2C%20wy666444%2C%20Robinlzw%2C%20Lucian-code233", "source": "cve@mitre.org"}, {"url": "https://mp.weixin.qq.com/s/IbRKrCKdMyIi-azkuqOOvg", "source": "cve@mitre.org"}, {"url": "https://www.tonbit.xyz/blog/post/TonBit-Discovers-Critical-Vulnerability-on-TON-Virtual-Machine-for-the-Third-Time-Once-Again-Receiving-Official-Recognition-from-the-TON-Team.html", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "A Null Pointer Dereference vulnerability exists in the TON Virtual Machine (TVM) within the TON Blockchain before v2025.06. The issue is located in the execution logic of the INMSGPARAM instruction, where the program fails to validate if a specific pointer is null before accessing it. By sending a malicious transaction or smart contract, an attacker can trigger this null pointer dereference, causing the validator node process to crash (segmentation fault). This results in a Denial of Service (DoS) affecting the availability of the entire blockchain network."}, {"lang": "es", "value": "Una vulnerabilidad de desreferencia de puntero nulo existe en la M\u00e1quina Virtual TON (TVM) dentro de la cadena de bloques TON antes de la v2025.06. El problema se encuentra en la l\u00f3gica de ejecuci\u00f3n de la instrucci\u00f3n INMSGPARAM, donde el programa no valida si un puntero espec\u00edfico es nulo antes de acceder a \u00e9l. Al enviar una transacci\u00f3n maliciosa o un contrato inteligente, un atacante puede desencadenar esta desreferencia de puntero nulo, provocando que el proceso del nodo validador falle (fallo de segmentaci\u00f3n). Esto resulta en una Denegaci\u00f3n de Servicio (DoS) que afecta la disponibilidad de toda la red de cadena de bloques."}], "lastModified": "2026-06-17T10:03:28.380", "sourceIdentifier": "cve@mitre.org"}