CVE-2018-7295: Square-Enix Final Fantasy Xiv

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

ffxivlauncher.exe in Square Enix Final Fantasy XIV 4.21 and 4.25 on Windows is affected by Improper Enforcement of Message Integrity During Transmission in a Communication Channel, allowing a man-in-the-middle attacker to steal user credentials because a session retrieves global.js via http before proceeding to use https. This is fixed in Patch 4.3.

Affected products

• Square-Enix Final Fantasy Xiv: version 4.21 only; version 4.25 only

Published 2018-05-23. Last modified 2026-06-17.