CVE-2025-58750 is a high severity (CVSS 8.2) out-of-bounds read and write in rAthena, the open source MMORPG server. Builds before commit 0cc348b lack a bounds check in chclif_parse_moveCharSlot. The fix is that commit, so pull the latest source, rebuild and restart.
What's affected
rAthena builds before commit 0cc348b, per the record and the GitHub advisory.
The fix is commit 0cc348b, with no release number given.
The affected function is chclif_parse_moveCharSlot, which handles input from the user, according to the record.
How to check if you're exposed
rAthena has no version number to compare. Fixes are identified by commit. In your clone, test whether the fix commit is already part of your build.
git fetch origin
git merge-base --is-ancestor 0cc348b HEAD && echo patched || echo not patched
If you run a build from a packaged archive, compare the date of your snapshot with the fix commit date on GitHub. Also confirm who can reach the server ports: game servers are usually exposed to the internet on purpose.
What to do now
- Update your rAthena source to include commit 0cc348b, rebuild and restart the char server.
- Run the server under a dedicated unprivileged user, in a container if you can.
- Monitor the char server for crashes and restarts, which can indicate probing.
- Keep database backups current so you can recover if memory corruption affects stored data.
- Keep management and configuration interfaces off the internet and off guest networks.
- Record the firmware or build version of every affected device so you can match it to a fix when one is published.
Why it matters
The function reads a value sent by the client and uses it as a position without checking that it falls inside the intended range. That allows reading and writing outside the intended memory. The CVSS vector shows low integrity impact and high availability impact, which fits a bug that more often crashes the service than anything else.
Still, memory corruption in a network facing service is never only about crashes, so patching is the right response.
The record classifies the weakness as CWE-119 (Improper Restriction of Operations within Memory Bounds) and CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write).
Memory corruption bugs like this one come from copying more data into a fixed region than it can hold, or reading and writing at a position that was never checked. Depending on the target, the result ranges from a crash to a change in program behavior. Embedded and native code is hit hardest because there is usually no managed runtime to catch the mistake.
The lasting fix is a bounds check on every length or index that arrives from outside the component. Until that fix ships, the practical defense is to limit who can reach the vulnerable code path at all, which usually means keeping management interfaces and internal services off untrusted networks.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
What is the main impact?
The vector shows high availability impact and low integrity impact, so crashes are the most likely outcome, though memory corruption can be worse.
Which commit fixes it?
Commit 0cc348b in the rAthena repository.
Sources
Last reviewed: 18 October 2026.
