CVE-2025-58750
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-09

Last updated on: 2025-09-17

Assigner: GitHub, Inc.

Description
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in `chclif_parse_moveCharSlot` that can result in reading and writing out of bounds using input from the user. The problem has been fixed in commit 0cc348b.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-09
Last Modified
2025-09-17
Generated
2026-06-16
AI Q&A
2025-09-10
EPSS Evaluated
2026-06-14
NVD
CVE-2025-58750
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
rathena rathena to 2025-09-06 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in rAthena, an open-source MMORPG server, is due to a missing bound check in the function chclif_parse_moveCharSlot. This flaw allows an attacker to cause out-of-bounds reading and writing by sending crafted input, potentially leading to unexpected behavior or crashes. The issue was fixed in commit 0cc348b.

Impact Analysis

The vulnerability can impact you by allowing an attacker to manipulate the server's memory through out-of-bounds access, which can lead to denial of service (server crashes) or potentially other malicious impacts. The CVSS score indicates a high severity with network attack vector and no user interaction required.

Mitigation Strategies

Update rAthena to include the fix from commit 0cc348b or later, as this commit addresses the missing bound check in chclif_parse_moveCharSlot. Until then, consider restricting access to the vulnerable service to trusted users only.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-58750. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart