External risk intelligence

rAthena MMORPG Server Missing Bounds Check in Move Character Slot

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-58750

rAthena is an MMORPG server software designed to be deployed as a public-facing service. By its nature as an online game server, it listens for network connections from game clients to facilitate gameplay, making it an internet-exposed service by design.

Memory Corruption

Rathena

before 2025-09-06

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An issue has been identified in the rAthena open-source MMORPG server software that could allow for unauthorized data access and modification. This vulnerability stems from a missing bounds check in a specific server function, enabling potential manipulation of data through user input. The primary concern is confirming whether this type of server is in use and if it is exposed to unauthorized access.

Server software vulnerable to data compromise.
Critical for confirming exposure and relevance.
Understand potential for unauthorized data access.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input to the rAthena game server, which processes user data without properly checking the boundaries of the data. This could allow an attacker to overwrite critical memory, potentially leading to a compromise of the server.

No special access needed to attack.
Input to `chclif_parse_moveCharSlot` triggers vulnerability.
Remote code execution or data corruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to read and write out of bounds within the rAthena server through specially crafted user input. This could potentially lead to the corruption or modification of game server data.

Game server data integrity.
Out-of-bounds read/write via input.
Server data corruption or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

rAthena is an open-source MMORPG server, making it a common internet-facing service. Responsibility for managing this software likely falls to the application owners or the infrastructure teams responsible for the game servers. The first step is to identify all instances of rAthena, confirm their reachability and business criticality, and then determine the accountable owner to plan remediation based on risk.

Own the issue and track remediation.
Verify exposure and business criticality.
Plan remediation and coordinate with vendors.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is rAthena?

rAthena is an open-source, cross-platform software framework used to host Massively Multiplayer Online Role Playing Game (MMORPG) servers. It manages core game logic, character data, and real-time interactions for players. Organizations and enthusiasts use it to run private or custom game worlds that must remain connected to the internet to allow remote game clients to join and play.

What does CVE-2025-58750 mean for rAthena?

This vulnerability is classified under memory safety weaknesses, specifically improper bounds checking (CWE-119, CWE-125, and CWE-787). In plain terms, the server fails to verify that user-provided data fits within the allocated memory space for a character movement function. This flaw allows processed input to read from or write to memory locations it should not access, which can corrupt or modify critical server data.

How is this vulnerability triggered?

The flaw is triggered when the server processes specific, maliciously crafted input directed at the `chclif_parse_moveCharSlot` function. The server performs no validation on the size or structure of this data before using it. Note that standard, well-formed game traffic used during normal play does not trigger this issue; it requires specifically designed input meant to exceed memory boundaries.

Why should I care about this server bug?

If you run an rAthena server, you should care because Halo Surface Signal indicates this software is designed as a public-facing service. Because the server must be reachable over the network to function, it is inherently internet-exposed. An attacker does not need special permissions to send the malicious input, meaning any instance accessible to the internet is a potential target for unauthorized data modification.

What should I do if I run rAthena?

Your first step is to inventory your environment to locate all active rAthena instances. Once identified, determine which servers are reachable from the internet and assess their business impact. You should then coordinate with your technical team to update the software to a version that includes the fix for commit 0cc348b, which addresses the bounds check error.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.