CVE-2025-58750
BaseFortify
Publication date: 2025-09-09
Last updated on: 2025-09-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rathena | rathena | to 2025-09-06 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in rAthena, an open-source MMORPG server, is due to a missing bound check in the function chclif_parse_moveCharSlot. This flaw allows an attacker to cause out-of-bounds reading and writing by sending crafted input, potentially leading to unexpected behavior or crashes. The issue was fixed in commit 0cc348b.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to manipulate the server's memory through out-of-bounds access, which can lead to denial of service (server crashes) or potentially other malicious impacts. The CVSS score indicates a high severity with network attack vector and no user interaction required.
What immediate steps should I take to mitigate this vulnerability?
Update rAthena to include the fix from commit 0cc348b or later, as this commit addresses the missing bound check in chclif_parse_moveCharSlot. Until then, consider restricting access to the vulnerable service to trusted users only.