What is CVE-2025-58447?

CVE-2025-58447 is a critical-severity vulnerability in Rathena, classified under Heap-based Buffer Overflow. CVSS score: 9.8/10. Published 2025-09-09.

How severe is CVE-2025-58447?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Buffer overflow in Rathena

CVE-2025-58447

rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote attacker to overwrite adjacent session fields by sending a crafted `CA_SSO_LOGIN_REQ` with an oversized token length. This leads to immediate denial of service (crash) and it is possible to achieve remote code execution via heap corruption. Commit 2f5248b fixes the issue.

Vulnerability class: Buffer Overflow

EPSS: 0.008 (53.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Rathena — versions < 2f5248b

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-58447?: CVE-2025-58447 is a critical-severity vulnerability in Rathena, classified under Heap-based Buffer Overflow. CVSS score: 9.8/10. Published 2025-09-09.
How severe is CVE-2025-58447?: Critical severity. CVSS v3 base score is 9.8 out of 10.