CVEvulnerability

CVE-2025-58447

9.8 CRITICAL Published 2025-09-09 Modified 2026-10-19 Official page ↗
Status
Analyzed
Published
2025-09-09
Last modified
2026-10-19
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-122, CWE-787

Description

rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote attacker to overwrite adjacent session fields by sending a crafted `CA_SSO_LOGIN_REQ` with an oversized token length. This leads to immediate denial of service (crash) and it is possible to achieve remote code execution via heap corruption. Commit 2f5248b fixes the issue.

Affected configurations

• rathena rathena (< 2025-09-06)

Related

Weakness · CWE (2)

  • CWE-122 Heap-based Buffer Overflow weakness
  • CWE-787 Out-of-bounds Write weakness

References