CVE-2025-62170 - CVE House

Back to Database

Status published High CVE-2025-62170

rAthena map-server use-after-free vulnerability in RODEX

7.5 CVSS

Vulnerability Description

rAthena is an open-source cross-platform MMORPG server. A use-after-free vulnerability exists in the RODEX functionality of rAthena's map-server in versions prior to commit af2f3ba. An unauthenticated attacker can exploit this vulnerability via a specific attacking scenario to cause a denial of service by crashing the map-server. This issue has been patched in commit af2f3ba. There are no known workarounds aside from manually applying the patch.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62170

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from rathena

View All →

CSRF in FluxCP account endpoints allows account takeover / state-changing actions

rAthena missing bound check in chclif_parse_moveCharSlot

rAthena has SQL Injection in PartyBooking component via `WorldName` parameter.

rAthena has heap-based buffer overflow in login server

Javascript Injection in Vending Info/Buyers Info Module in FluxCP

Affected Vendor

rathena

View all reports →

Affected Software

rathena

Vulnerable Versions:

< af2f3ba33fc03dc6dd510f8cfe84cd9185af748d

Timeline

Official Publish: October 13th, 2025

Last Modified: October 27th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1055 Process Injection

Defense Evasion

T1105 Ingress Tool Transfer

Command and Control

T1485 Data Destruction