Vulnerability Description
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote attacker to overwrite adjacent session fields by sending a crafted `CA_SSO_LOGIN_REQ` with an oversized token length. This leads to immediate denial of service (crash) and it is possible to achieve remote code execution via heap corruption. Commit 2f5248b fixes the issue.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rathena | Rathena | < 2025-09-06 |
Related Weaknesses (CWE)
References
- https://github.com/rathena/rathena/commit/2f5248b9cd9a8c6b42422ddecfc4cc2cd0e69ePatch
- https://github.com/rathena/rathena/security/advisories/GHSA-4p33-6xqr-cm6xVendor Advisory
FAQ
What is CVE-2025-58447?
CVE-2025-58447 is a vulnerability with a CVSS score of 9.8 (CRITICAL). rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote ...
How severe is CVE-2025-58447?
CVE-2025-58447 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-58447?
Check the references section above for vendor advisories and patch information. Affected products include: Rathena Rathena.