What is CVE-2025-58447?

CVE-2025-58447 is a critical-severity vulnerability in Rathena, classified under Heap-based Buffer Overflow. CVSS score: 9.8/10. Published 2025-09-09.

How severe is CVE-2025-58447?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Buffer overflow in Rathena

CVE-2025-58447

rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote attacker to overwrite adjacent session fields by sending a crafted `CA_SSO_LOGIN_REQ` with an oversized token length. This leads to immediate denial of service (crash) and it is possible to achieve remote code execution via heap corruption. Commit 2f5248b fixes the issue.

Vulnerability class: Buffer Overflow

Published 2025-09-09 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.009 (57.5th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 57th percentile — 57.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000

Affected products

Rathena — versions < 2f5248b

Weakness classification (CWE)

References

github.com/rathena/rathena/security/advisories/GHSA-4p33-6xqr-cm6x (Vendor Advisory)
github.com/rathena/rathena/commit/2f5248b9cd9a8c6b42422ddecfc4cc2cd0e69e4b (Patch)

Frequently asked questions

What is CVE-2025-58447?: CVE-2025-58447 is a critical-severity vulnerability in Rathena, classified under Heap-based Buffer Overflow. CVSS score: 9.8/10. Published 2025-09-09.
How severe is CVE-2025-58447?: Critical severity. CVSS v3 base score is 9.8 out of 10.