CVE-2025-62170
📋 TL;DR
A use-after-free vulnerability in rAthena's RODEX functionality allows unauthenticated attackers to crash the map-server, causing denial of service. This affects all rAthena servers running vulnerable versions before the patch. Game administrators need to patch immediately to prevent server disruption.
💻 Affected Systems
- rAthena
📦 What is this software?
Rathena by Rathena
⚠️ Risk & Real-World Impact
Worst Case
Complete map-server crash leading to game service disruption for all players on affected maps, potentially requiring manual server restart.
Likely Case
Intermittent map-server crashes causing player disconnections and service interruptions until patched.
If Mitigated
No impact if patched; unpatched servers remain vulnerable to DoS attacks.
🎯 Exploit Status
The advisory describes a specific attacking scenario but no public exploit code is available. Unauthenticated nature makes exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit af2f3ba or later
Vendor Advisory: https://github.com/rathena/rathena/security/advisories/GHSA-9mj9-8vgv-r92j
Restart Required: Yes
Instructions:
1. Backup current rAthena installation
2. Update to commit af2f3ba or later: git pull origin master
3. Recompile map-server: make clean && make server
4. Restart map-server process
🔧 Temporary Workarounds
Disable RODEX functionality
allTemporarily disable the RODEX mail system to prevent exploitation
Edit conf/import/mail_conf.txt and set 'enable' to 'no'
🧯 If You Can't Patch
- Implement network segmentation to isolate rAthena servers from untrusted networks
- Deploy rate limiting or WAF rules to block suspicious RODEX-related traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check git log for commit af2f3ba: git log --oneline | grep af2f3baCheck Version:
git log --oneline -1Verify Fix Applied:
Verify current commit includes af2f3ba: git rev-parse HEAD📡 Detection & Monitoring
Log Indicators:
- map-server crash logs
- segmentation fault errors in server logs
- unexpected map-server process termination
Network Indicators:
- Unusual RODEX packet patterns from single sources
- Multiple connection attempts to map-server port
SIEM Query:
source="rathena.log" AND ("segmentation fault" OR "crash" OR "SIGSEGV")