A critical use-after-free vulnerability in the rAthena MMORPG server allows unauthenticated attackers to remotely crash the application, resulting in service denial.

This is a use-after-free vulnerability (CWE-416) within the RODEX functionality of the map-server. An unauthenticated attacker can trigger this flaw through a specific network interaction to crash the server process.

Successful exploitation of this vulnerability results in an immediate denial of service for the MMORPG server, disrupting gameplay for all connected users. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to service availability and operational continuity, as it requires no prior authentication or user interaction to execute.

Immediate Action: Apply the vendor-provided patch by updating the rAthena server to the latest version or manually applying the fix found in commit af2f3ba33fc03dc6dd510f8cfe84cd9185af748d.

Proactive Monitoring: Monitor server logs for unexpected process crashes or frequent restarts of the map-server component.

Compensating Controls: Implement network-level rate limiting or a Web Application Firewall, if applicable to the game protocol traffic, to filter abnormal requests directed at the RODEX service.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

The vulnerability represents a significant stability risk to rAthena environments. Administrators should prioritize the application of the official security patch to address the underlying use-after-free condition. Failure to patch leaves the server susceptible to trivial denial-of-service attacks that can be launched by any external actor.