PocketMine-MP before version 4.0.7 has an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON. Attackers can send specially crafted form response packets with invalid JSON, triggering an uncaught InvalidArgumentException that causes the server to crash. This denial-of-service condition can interrupt gameplay and potentially lead to further disruption if the server is unable to reload or recover gracefully. The weakness is classified as CWE‑248, which describes an unhandled exception that can lead to unstable behavior. The impact is limited to availability; confidentiality and integrity are not directly affected, though repeated crashes can cause loss of service and disrupt player experience. The vulnerability’s scope is confined to servers receiving packet data from clients, meaning a remote attacker does not need local access.

The affected product is PocketMine‑MP, a server implementation for Minecraft Bedrock Edition, prior to version 4.0.7. Any instance of this software running an unpatched version is susceptible. No specific build or patch number is listed beyond the 4.0.7 threshold. The vulnerability applies to all installations that allow clients to send modal form responses, which is a common feature in custom plugins or default server behavior.

The CVSS base score of 7.1 indicates a high severity risk of exploitation. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread attacks yet. However, the unhandled exception and the ability of attackers to trigger it with crafted JSON packets imply a realistic attack path over an open network connection. Without a mitigation, any client that can send malformed JSON can trigger repeated server restarts, leading to denial of service for legitimate players. Because the exploit requires only network-level communication, it is accessible to remote attackers with no authentication or privileged access needed.