Read the docs
TI-2025-36408 Aliases CVE-2025-58750

rAthena missing bound check in chclif_parse_moveCharSlot

Priority MEDIUM 45CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in `chclif_parse_moveCharSlot` that can result in reading and writing out of bounds using input from the user. The problem has been fixed in commit 0cc348b.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.003 22nd percentileScored 2026-11-07
Fix Fixed rathena (rathena): 0cc348b

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rathenarathenabefore 0cc348b0cc348bPatch availableCNA
  • rathena Vendorrathena Affected before 0cc348b Fixed in 0cc348b Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rathena:rathena:*:*:*:*:*:*:*:*before 2025-09-06Vulnerablerathena
  • cpe:2.3:a:rathena:rathena:*:*:*:*:*:*:*:* Versions before 2025-09-06 Vulnerable ·rathena

Remediation

  • Fix · CNA rathena (rathena) Fixed in 0cc348b

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-58750

References

Patch 1

Advisory 1

  • TI-2025-36205 rAthena has heap-based buffer overflow in login server CVSS 3.1CRITICAL 9.8
  • TI-2025-36206 rAthena has SQL Injection in PartyBooking component via `WorldName` parameter. CVSS 3.1CRITICAL 9.8
  • TI-2025-38488 rAthena map-server use-after-free vulnerability in RODEX CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences