rAthena has heap-based buffer overflow in login server

published 2025-09-09 13 mo ago modified 2026-10-19 20 d ago also EUVD-2025-34018

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits: 0; none known

rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote attacker to overwrite adjacent session fields by sending a crafted `CA_SSO_LOGIN_REQ` with an oversized token length. This leads to immediate denial of service (crash) and it is possible to achieve remote code execution via heap corruption. Commit 2f5248b fixes the issue.

Patch / fix

fixed in 1 links 1

rathena rathena 2025-09-06

github.com/rathena/rathena@2f5248b commit

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 13 mo ago (2025-09-10)

Exploit prediction

0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

rathena rathena

Classification

Weakness

CWE-122 Heap-based Buffer Overflow
CWE-787 Out-of-bounds Write

References

Sources

CVE List CVE-2025-58447
NVD CVE-2025-58447

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary