PT-2025-36991 · Athena · Rathena

Ramadhanamizudin · Published 2025-09-09 · Updated 2025-09-17 · CVE-2025-58447

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: rAthena versions prior to commit 2f5248b

Description: rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. A heap-based buffer overflow exists in the login server. Sending a crafted CA SSO LOGIN REQ packet with an oversized token length to the server can overwrite adjacent session fields, leading to a denial of service (crash). It may be possible to achieve remote code execution via heap corruption. The vulnerability is triggered by the CA SSO LOGIN REQ packet and involves an oversized token length.

Recommendations: Update to commit 2f5248b or later.

Exploit

Fix

DoS

RCE

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

CVE-2025-58447

GHSA-4P33-6XQR-CM6X

Affected Products

Rathena

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58447.json · Exploit
• https://github.com/rathena/rathena/security/advisories/GHSA-4p33-6xqr-cm6x · Vendor Advisory
• https://github.com/rathena/rathena/commit/2f5248b9cd9a8c6b42422ddecfc4cc2cd0e69e4b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-58447 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58447 · Vendor Advisory
• https://twitter.com/CVEnew/status/1965557675866874297 · Twitter Post
• https://t.me/cveNotify/135726 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1965612496196149535 · Twitter Post