CVE-2025-58447
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
In rAthena versions prior to commit 2f5248b, a heap-based buffer overflow exists in the login server; a remote attacker can overwrite adjacent session fields by sending a crafted CA_SSO_LOGIN_REQ with an oversized token length. This leads to immediate denial of service (crash) and remote code execution is possible via heap corruption. Commit 2f5248b fixes the issue.
Risk Assessment
A remote attacker can crash the login server and potentially execute arbitrary code via heap corruption. High risk for publicly accessible rAthena servers.
Recommendation
Update rAthena to commit 2f5248b or later. Until updated, restrict network access to the login server.
Other vulnerabilities in rAthena
See all- CVE-2025-58448Critical
rAthena prior to commit 0d89ae0 has a SQL Injection in the PartyBooking component via the WorldName parameter. Commit 0d89ae0 fixes the issue.
- CVE-2025-62170High
In rAthena versions prior to commit af2f3ba, a use-after-free vulnerability exists in the RODEX functionality of the map-server. An unauthenticated attacker can exploit this in a specific attack scenario to cause a denial of service by crashing the map-server.
- CVE-2025-58750High
rAthena is an open-source cross-platform MMORPG server. Versions prior to commit 0cc348b are missing a bound check in chclif_parse_moveCharSlot that can result in reading and writing out of bounds using input from the user.
Original NVD description (English source)
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote attacker to overwrite adjacent session fields by sending a crafted `CA_SSO_LOGIN_REQ` with an oversized token length. This leads to immediate denial of service (crash) and it is possible to achieve remote code execution via heap corruption. Commit 2f5248b fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS