CVE-2025-58750

rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in `chclif_parse_moveCharSlot` that can result in reading and writing out of bounds using input from the user. The problem has been fixed in commit 0cc348b.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/rathena/rathena/commit/0cc348b186bbcc3c604c17c39589a319f27d469b	Patch
https://github.com/rathena/rathena/security/advisories/GHSA-pjh7-jgr8-4ff6	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:rathena:rathena:*:*:*:*:*:*:*:*

History

19 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) rAthena es un servidor de juego de rol multijugador masivo en línea (MMORPG) multiplataforma de código abierto. Las versiones anteriores al commit 0cc348b carecen de una comprobación de límites en 'chclif_parse_moveCharSlot' que puede resultar en lectura y escritura fuera de los límites utilizando la entrada del usuario. El problema ha sido solucionado en el commit 0cc348b.

Information

Published : 2025-09-09 23:15

Updated : 2026-10-19 17:10

NVD link : CVE-2025-58750

Mitre link : CVE-2025-58750

CVE.ORG link : CVE-2025-58750

JSON object : View

Products Affected

rathena

rathena

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-125

Out-of-bounds Read

CWE-787

Out-of-bounds Write

{"id": "CVE-2025-58750", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58750", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-10T18:05:45.445509Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "rathena", "product": "rathena", "versions": [{"status": "affected", "version": "< 0cc348b"}]}]}], "published": "2025-09-09T23:15:36.870", "references": [{"url": "https://github.com/rathena/rathena/commit/0cc348b186bbcc3c604c17c39589a319f27d469b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rathena/rathena/security/advisories/GHSA-pjh7-jgr8-4ff6", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-787"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in `chclif_parse_moveCharSlot` that can result in reading and writing out of bounds using input from the user. The problem has been fixed in commit 0cc348b."}, {"lang": "es", "value": "rAthena es un servidor de juego de rol multijugador masivo en l\u00ednea (MMORPG) multiplataforma de c\u00f3digo abierto. Las versiones anteriores al commit 0cc348b carecen de una comprobaci\u00f3n de l\u00edmites en 'chclif_parse_moveCharSlot' que puede resultar en lectura y escritura fuera de los l\u00edmites utilizando la entrada del usuario. El problema ha sido solucionado en el commit 0cc348b."}], "lastModified": "2026-10-19T17:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rathena:rathena:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B83A684A-6132-43B6-82AE-F7286BA9849C", "versionEndExcluding": "2025-09-06"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}