CVE-2025-70956
Published: 13 February 2026
Summary
CVE-2025-70956 is a high-severity Prototype Pollution (CWE-1321) vulnerability in Qq (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 26.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables remote exploitation of the TVM to trigger OOG-induced state corruption, directly causing application/system denial of service.
NVD Description
A State Pollution vulnerability was discovered in the TON Virtual Machine (TVM) before v2025.04. The issue exists in the RUNVM instruction logic (VmState::run_child_vm), which is responsible for initializing child virtual machines. The operation moves critical resources (specifically libraries and log)…
more
from the parent state to a new child state in a non-atomic manner. If an Out-of-Gas (OOG) exception occurs after resources are moved but before the state transition is finalized, the parent VM retains a corrupted state where these resources are emptied/invalid. Because RUNVM supports gas isolation, the parent VM continues execution with this corrupted state, leading to unexpected behavior or denial of service within the contract's context.
Deeper analysisAI
CVE-2025-70956 is a State Pollution vulnerability in the TON Virtual Machine (TVM) prior to version v2025.04. The flaw resides in the RUNVM instruction logic within VmState::run_child_vm, which handles initialization of child virtual machines. This logic moves critical resources, such as libraries and logs, from the parent state to the new child state in a non-atomic manner. If an Out-of-Gas (OOG) exception occurs after the resources are moved but before the state transition finalizes, the parent VM is left in a corrupted state with these resources emptied or invalidated. Due to gas isolation in RUNVM, the parent VM continues execution with this corruption, resulting in unexpected behavior or denial of service within the affected contract's context. The vulnerability is rated 7.5 on the CVSS 3.1 scale (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-1321.
Attackers can exploit this vulnerability remotely without privileges or user interaction by invoking a smart contract on the TON blockchain that executes the RUNVM instruction. By crafting a transaction that triggers an OOG exception at the precise point after resource transfer but before state finalization, an attacker corrupts the parent VM's state. This leads to denial of service or erratic contract behavior, such as failed operations or invalid state handling, confined to the targeted contract's execution environment.
Mitigation is addressed in the TON blockchain repository through commit 1835d84602bbaaa1593270d7ab3bb0b499920416, incorporated into the v2025.04 release. Security practitioners should ensure TON nodes and contracts upgrade to TVM v2025.04 or later to resolve the non-atomic resource handling issue, as detailed in the associated GitHub release notes and a technical gist providing further analysis.
Details
- CWE(s)