Read the docs
TI-2025-36205 Aliases CVE-2025-58447

rAthena has heap-based buffer overflow in login server

Priority MEDIUM 50CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote attacker to overwrite adjacent session fields by sending a crafted `CA_SSO_LOGIN_REQ` with an oversized token length. This leads to immediate denial of service (crash) and it is possible to achieve remote code execution via heap corruption. Commit 2f5248b fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00878 59th percentileScored 2026-11-07
Fix Fixed rathena (rathena): 2f5248b

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rathenarathenabefore 2f5248b2f5248bPatch availableCNA
  • rathena Vendorrathena Affected before 2f5248b Fixed in 2f5248b Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rathena:rathena:*:*:*:*:*:*:*:*before 2025-09-06Vulnerablerathena
  • cpe:2.3:a:rathena:rathena:*:*:*:*:*:*:*:* Versions before 2025-09-06 Vulnerable ·rathena

Remediation

  • Fix · CNA rathena (rathena) Fixed in 2f5248b

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-58447

References

Patch 1

Advisory 1

  • TI-2025-36206 rAthena has SQL Injection in PartyBooking component via `WorldName` parameter. CVSS 3.1CRITICAL 9.8
  • TI-2025-36408 rAthena missing bound check in chclif_parse_moveCharSlot CVSS 3.1CRITICAL 9.1
  • TI-2025-38488 rAthena map-server use-after-free vulnerability in RODEX CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences