External risk intelligence

rAthena MMORPG Server Heap Overflow Denial of Service and Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-58447

rAthena is an MMORPG server software designed to handle public client connections. The login server component, where this vulnerability resides, is intentionally exposed to the internet to allow players to authenticate and join the game, making it a public-facing service by design.

Out-of-bounds Write

Rathena

before 2025-09-06

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in rAthena, an open-source game server software, allows remote attackers to cause denial of service or potentially execute code by sending specially crafted login requests. This could impact the availability and integrity of game services.

Remote attackers can crash game servers or run code.
Confirms need for diligent software supply chain management.
Assess relevance to ensure game service integrity.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted login request to the rAthena game server over the network. This request, containing an oversized token, targets the login server's handling of `CA_SSO_LOGIN_REQ` messages. Successful exploitation could allow an attacker to overwrite memory, potentially leading to remote code execution or a server crash.

No special access required.
Crafted login request triggers overflow.
Remote code execution or crash.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the rAthena MMORPG server's login component could allow an unauthenticated remote attacker to crash the server or potentially execute arbitrary code by sending a specially crafted login request. This could affect the availability and integrity of the game service when supported by the advisory.

Game server availability and integrity.
Crafted network request to login server.
Denial of service or remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The rAthena community and administrators responsible for MMORPG servers are the primary stakeholders for this vulnerability. The first practical step is to identify all running rAthena servers, confirm their exposure and criticality, and then coordinate with the relevant teams or individuals to plan the fix.

Identify server instances and owners.
Verify public exposure and criticality.
Plan for maintenance and apply fix.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is rAthena?

rAthena is an open-source, cross-platform software framework used to host Massively Multiplayer Online Role Playing Game (MMORPG) servers. It provides the backend infrastructure required to manage game data and facilitate player connectivity.

What does CVE-2025-58447 mean?

This CVE identifies a heap-based buffer overflow, categorized as CWE-122 and CWE-787. In plain terms, the server fails to properly check the size of incoming data, allowing an attacker to overwrite nearby memory. This can crash the service or enable unauthorized code execution.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted login request, specifically a `CA_SSO_LOGIN_REQ` message, to the server with an excessively long token. Legitimate login requests with standard, correctly sized tokens do not trigger this memory corruption.

Why should I care about this vulnerability?

According to Halo Surface Signal, rAthena login servers are designed to be internet-facing to support player authentication, making them inherently accessible to remote attackers. If your server is reachable over the network, it is a candidate for this attack.

Do I need to update my rAthena software?

Yes. If you are running a version prior to commit 2f5248b, your server is vulnerable. The first step is to locate all your rAthena instances and apply the official fix provided in the project's repository to secure your service.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.