CVE-2025-58750
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
rAthena is an open-source cross-platform MMORPG server. Versions prior to commit 0cc348b are missing a bound check in chclif_parse_moveCharSlot that can result in reading and writing out of bounds using input from the user.
Risk Assessment
An attacker could exploit this to read or write out of bounds, potentially leading to code execution or data disclosure. This may compromise the integrity and availability of the game server.
Recommendation
Update rAthena to commit 0cc348b or later, which contains the fix. Monitor for unusual server behavior.
Other vulnerabilities in rAthena
See all- CVE-2025-58448Critical
rAthena prior to commit 0d89ae0 has a SQL Injection in the PartyBooking component via the WorldName parameter. Commit 0d89ae0 fixes the issue.
- CVE-2025-58447Critical
In rAthena versions prior to commit 2f5248b, a heap-based buffer overflow exists in the login server; a remote attacker can overwrite adjacent session fields by sending a crafted CA_SSO_LOGIN_REQ with an oversized token length. This leads to immediate denial of service (crash) and remote code execution is possible via heap corruption. Commit 2f5248b fixes the issue.
- CVE-2025-62170High
In rAthena versions prior to commit af2f3ba, a use-after-free vulnerability exists in the RODEX functionality of the map-server. An unauthenticated attacker can exploit this in a specific attack scenario to cause a denial of service by crashing the map-server.
Original NVD description (English source)
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in `chclif_parse_moveCharSlot` that can result in reading and writing out of bounds using input from the user. The problem has been fixed in commit 0cc348b.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS