CVE-2025-58447

rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote attacker to overwrite adjacent session fields by sending a crafted `CA_SSO_LOGIN_REQ` with an oversized token length. This leads to immediate denial of service (crash) and it is possible to achieve remote code execution via heap corruption. Commit 2f5248b fixes the issue.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/rathena/rathena/commit/2f5248b9cd9a8c6b42422ddecfc4cc2cd0e69e4b	Patch
https://github.com/rathena/rathena/security/advisories/GHSA-4p33-6xqr-cm6x	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:rathena:rathena:*:*:*:*:*:*:*:*

History

19 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) rAthena es un servidor de juego de rol multijugador masivo en línea (MMORPG) de código abierto y multiplataforma. Las versiones anteriores al commit 2f5248b tienen un desbordamiento de búfer basado en montículo en el servidor de inicio de sesión, lo que permite a un atacante remoto sobrescribir campos de sesión adyacentes enviando un 'CA_SSO_LOGIN_REQ' manipulado con una longitud de token excesiva. Esto conduce a una denegación de servicio inmediata (caída) y es posible lograr la ejecución remota de código mediante corrupción de montículo. El commit 2f5248b corrige el problema.

Information

Published : 2025-09-09 23:15

Updated : 2026-10-19 17:10

NVD link : CVE-2025-58447

Mitre link : CVE-2025-58447

CVE.ORG link : CVE-2025-58447

JSON object : View

Products Affected

rathena

rathena

CWE

CWE-122

Heap-based Buffer Overflow

CWE-787

Out-of-bounds Write

{"id": "CVE-2025-58447", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58447", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-10T19:29:58.880314Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "rathena", "product": "rathena", "versions": [{"status": "affected", "version": "< 2f5248b"}]}]}], "published": "2025-09-09T23:15:36.497", "references": [{"url": "https://github.com/rathena/rathena/commit/2f5248b9cd9a8c6b42422ddecfc4cc2cd0e69e4b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rathena/rathena/security/advisories/GHSA-4p33-6xqr-cm6x", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-122"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote attacker to overwrite adjacent session fields by sending a crafted `CA_SSO_LOGIN_REQ` with an oversized token length. This leads to immediate denial of service (crash) and it is possible to achieve remote code execution via heap corruption. Commit 2f5248b fixes the issue."}, {"lang": "es", "value": "rAthena es un servidor de juego de rol multijugador masivo en l\u00ednea (MMORPG) de c\u00f3digo abierto y multiplataforma. Las versiones anteriores al commit 2f5248b tienen un desbordamiento de b\u00fafer basado en mont\u00edculo en el servidor de inicio de sesi\u00f3n, lo que permite a un atacante remoto sobrescribir campos de sesi\u00f3n adyacentes enviando un 'CA_SSO_LOGIN_REQ' manipulado con una longitud de token excesiva. Esto conduce a una denegaci\u00f3n de servicio inmediata (ca\u00edda) y es posible lograr la ejecuci\u00f3n remota de c\u00f3digo mediante corrupci\u00f3n de mont\u00edculo. El commit 2f5248b corrige el problema."}], "lastModified": "2026-10-19T17:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rathena:rathena:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B83A684A-6132-43B6-82AE-F7286BA9849C", "versionEndExcluding": "2025-09-06"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}