rAthena CVE-2025-62170

Exploitation targets the RODEX in-game mail functionality of the rAthena map-server, specifically the clif_mail_removeitem routine, where sd->mail.item[i].index was used to index sd->inventory_data without bounds (0..MAX_INVENTORY) or null validation, yielding a use-after-free/out-of-bounds dereference. The description states an unauthenticated attacker can trigger it (consistent with CVSS PR:N) but only 'via a specific attacking scenario,' so a particular crafted mail/inventory state is required rather than a single trivial packet. Limiting factors: the target must be a reachable, running map-server (private RO servers are typically internet-exposed to players); impact is confined to a crash/DoS (no C/I impact); and only versions prior to commit af2f3ba are affected, so patched/updated servers are not exploitable.

This is a CWE-416 use-after-free in the RODEX (mail) handling of rAthena's map-server, scored CVSS 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - a pure availability impact (A:H), with no confidentiality or integrity loss. The network, low-complexity, no-privilege, no-interaction vector would normally signal easy mass exploitation, but the impact ceiling is a denial of service only: crashing the map-server, not code execution or data compromise. There is no EPSS score, KEV listing, or POC in the provided data, so exploitation is 'no public exploit identified at time of analysis'; the only available exploit-relevant artifact is the vendor patch commit (af2f3ba), which reveals the root cause (a missing bounds check on sd->mail.item[i].index into inventory_data plus a missing null check) but is a fix, not weaponized attack code. One tension to verify: the description calls the attacker 'unauthenticated' and the CVSS vector agrees (PR:N), yet RODEX is an in-game mail feature typically reached by a connected game client, and the description's own qualifier 'via a specific attacking scenario' implies a non-trivial precondition - so the real-world ease of reaching this code path may be lower than AC:L/PR:N suggests. Net: a genuine availability risk for operators of exposed rAthena map-servers, but a DoS-only bug in niche hobbyist software, not a critical RCE priority; patch on normal maintenance cadence.

An attacker interacting with an exposed rAthena map-server triggers the RODEX mail removeitem code path with a crafted mail/inventory state, causing clif_mail_removeitem to dereference a freed or out-of-range inventory_data entry. The resulting use-after-free crashes the map-server, disconnecting all players. No public exploit code is identified; only the vendor fix commit is available, and the description notes a 'specific attacking scenario' is required.