CVE-2025-62170
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In rAthena versions prior to commit af2f3ba, a use-after-free vulnerability exists in the RODEX functionality of the map-server. An unauthenticated attacker can exploit this in a specific attack scenario to cause a denial of service by crashing the map-server.
Risk Assessment
The game server can be remotely crashed without authentication, leading to service unavailability for all players.
Recommendation
Update rAthena to commit af2f3ba or later, which contains the fix.
Other vulnerabilities in rAthena
See all- CVE-2025-58448Critical
rAthena prior to commit 0d89ae0 has a SQL Injection in the PartyBooking component via the WorldName parameter. Commit 0d89ae0 fixes the issue.
- CVE-2025-58447Critical
In rAthena versions prior to commit 2f5248b, a heap-based buffer overflow exists in the login server; a remote attacker can overwrite adjacent session fields by sending a crafted CA_SSO_LOGIN_REQ with an oversized token length. This leads to immediate denial of service (crash) and remote code execution is possible via heap corruption. Commit 2f5248b fixes the issue.
- CVE-2025-58750High
rAthena is an open-source cross-platform MMORPG server. Versions prior to commit 0cc348b are missing a bound check in chclif_parse_moveCharSlot that can result in reading and writing out of bounds using input from the user.
Original NVD description (English source)
rAthena is an open-source cross-platform MMORPG server. A use-after-free vulnerability exists in the RODEX functionality of rAthena's map-server in versions prior to commit af2f3ba. An unauthenticated attacker can exploit this vulnerability via a specific attacking scenario to cause a denial of service by crashing the map-server. This issue has been patched in commit af2f3ba. There are no known workarounds aside from manually applying the patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS