CVE-2025-58750 - Vulnerability Details - OpenCVE

rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in `chclif_parse_moveCharSlot` that can result in reading and writing out of bounds using input from the user. The problem has been fixed in commit 0cc348b.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Rathena	Rathena

No data.

No data.

References

Link	Providers
https://github.com/rathena/rathena/commit/0cc348b186bbcc3c604c17c39589a319f27d469b
https://github.com/rathena/rathena/security/advisories/GHSA-pjh7-jgr8-4ff6

History

Fri, 12 Sep 2025 09:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Rathena Rathena rathena
Vendors & Products		Rathena Rathena rathena

Wed, 10 Sep 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 09 Sep 2025 22:30:00 +0000

Type	Values Removed	Values Added
Description		rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in `chclif_parse_moveCharSlot` that can result in reading and writing out of bounds using input from the user. The problem has been fixed in commit 0cc348b.
Title		rAthena missing bound check in chclif_parse_moveCharSlot
Weaknesses		CWE-119 CWE-125 CWE-787
References		https://github.com/rathena/rathena/commit/0cc348b186bbcc3c604c17c39589a319f27d469b https://github.com/rathena/rathena/security/advisories/GHSA-pjh7-jgr8-4ff6
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2025-09-09T22:14:40.265Z

Updated: 2025-09-10T18:14:55.677Z

Reserved: 2025-09-04T19:18:09.498Z

Link: CVE-2025-58750

Vulnrichment

Updated: 2025-09-10T18:06:42.518Z

NVD

Status : Awaiting Analysis

Published: 2025-09-09T23:15:36.870

Modified: 2025-09-11T17:14:10.147

Link: CVE-2025-58750

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-58750", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-04T19:18:09.498Z", "datePublished": "2025-09-09T22:14:40.265Z", "dateUpdated": "2025-09-10T18:14:55.677Z"}, "containers": {"cna": {"title": "rAthena missing bound check in chclif_parse_moveCharSlot", "problemTypes": [{"descriptions": [{"cweId": "CWE-119", "lang": "en", "description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/rathena/rathena/security/advisories/GHSA-pjh7-jgr8-4ff6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rathena/rathena/security/advisories/GHSA-pjh7-jgr8-4ff6"}, {"name": "https://github.com/rathena/rathena/commit/0cc348b186bbcc3c604c17c39589a319f27d469b", "tags": ["x_refsource_MISC"], "url": "https://github.com/rathena/rathena/commit/0cc348b186bbcc3c604c17c39589a319f27d469b"}], "affected": [{"vendor": "rathena", "product": "rathena", "versions": [{"version": "< 0cc348b", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-09T22:14:40.265Z"}, "descriptions": [{"lang": "en", "value": "rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in `chclif_parse_moveCharSlot` that can result in reading and writing out of bounds using input from the user. The problem has been fixed in commit 0cc348b."}], "source": {"advisory": "GHSA-pjh7-jgr8-4ff6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-10T18:05:45.445509Z", "id": "CVE-2025-58750", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T18:14:55.677Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-58750", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-10T18:05:45.445509Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T18:06:42.518Z"}}], "cna": {"title": "rAthena missing bound check in chclif_parse_moveCharSlot", "source": {"advisory": "GHSA-pjh7-jgr8-4ff6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "rathena", "product": "rathena", "versions": [{"status": "affected", "version": "< 0cc348b"}]}], "references": [{"url": "https://github.com/rathena/rathena/security/advisories/GHSA-pjh7-jgr8-4ff6", "name": "https://github.com/rathena/rathena/security/advisories/GHSA-pjh7-jgr8-4ff6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/rathena/rathena/commit/0cc348b186bbcc3c604c17c39589a319f27d469b", "name": "https://github.com/rathena/rathena/commit/0cc348b186bbcc3c604c17c39589a319f27d469b", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in `chclif_parse_moveCharSlot` that can result in reading and writing out of bounds using input from the user. The problem has been fixed in commit 0cc348b."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-09T22:14:40.265Z"}}}, "cveMetadata": {"cveId": "CVE-2025-58750", "state": "PUBLISHED", "dateUpdated": "2025-09-10T18:14:55.677Z", "dateReserved": "2025-09-04T19:18:09.498Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-09-09T22:14:40.265Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}