CVE-2025-62170

rAthena is an open-source cross-platform MMORPG server. A use-after-free vulnerability exists in the RODEX functionality of rAthena's map-server in versions prior to commit af2f3ba. An unauthenticated attacker can exploit this vulnerability via a specific attacking scenario to cause a denial of service by crashing the map-server. This issue has been patched in commit af2f3ba. There are no known workarounds aside from manually applying the patch.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/rathena/rathena/commit/af2f3ba33fc03dc6dd510f8cfe84cd9185af748d	Patch
https://github.com/rathena/rathena/security/advisories/GHSA-9mj9-8vgv-r92j	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:rathena:rathena:*:*:*:*:*:*:*:*

History

19 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) rAthena es un servidor MMORPG de código abierto multiplataforma. Una vulnerabilidad de uso después de liberación existe en la funcionalidad RODEX del map-server de rAthena en versiones anteriores al commit af2f3ba. Un atacante no autenticado puede explotar esta vulnerabilidad mediante un escenario de ataque específico para causar una denegación de servicio al bloquear el map-server. Este problema ha sido parcheado en el commit af2f3ba. No se conocen soluciones alternativas aparte de aplicar manualmente el parche.

Information

Published : 2025-10-13 18:15

Updated : 2026-10-19 16:10

NVD link : CVE-2025-62170

Mitre link : CVE-2025-62170

CVE.ORG link : CVE-2025-62170

JSON object : View

Products Affected

rathena

rathena

CWE

CWE-416

Use After Free

{"id": "CVE-2025-62170", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62170", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-27T16:11:27.822868Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "rathena", "product": "rathena", "versions": [{"status": "affected", "version": "< af2f3ba33fc03dc6dd510f8cfe84cd9185af748d"}]}]}], "published": "2025-10-13T18:15:34.980", "references": [{"url": "https://github.com/rathena/rathena/commit/af2f3ba33fc03dc6dd510f8cfe84cd9185af748d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rathena/rathena/security/advisories/GHSA-9mj9-8vgv-r92j", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "rAthena is an open-source cross-platform MMORPG server. A use-after-free vulnerability exists in the RODEX functionality of rAthena's map-server in versions prior to commit af2f3ba. An unauthenticated attacker can exploit this vulnerability via a specific attacking scenario to cause a denial of service by crashing the map-server. This issue has been patched in commit af2f3ba. There are no known workarounds aside from manually applying the patch."}, {"lang": "es", "value": "rAthena es un servidor MMORPG de c\u00f3digo abierto multiplataforma. Una vulnerabilidad de uso despu\u00e9s de liberaci\u00f3n existe en la funcionalidad RODEX del map-server de rAthena en versiones anteriores al commit af2f3ba. Un atacante no autenticado puede explotar esta vulnerabilidad mediante un escenario de ataque espec\u00edfico para causar una denegaci\u00f3n de servicio al bloquear el map-server. Este problema ha sido parcheado en el commit af2f3ba. No se conocen soluciones alternativas aparte de aplicar manualmente el parche."}], "lastModified": "2026-10-19T16:10:00.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rathena:rathena:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE156285-7E1C-46E1-A2CA-562FB8A9D664", "versionEndExcluding": "2025-10-12"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}