PocketMine-MP versions before 4.0.6 fail to validate facing values in PlayerActionPacket and UseItemTransactionData. A crafted packet with an invalid or out‑of‑range facing value can cause the server to crash, resulting in a denial of service. This weakness stems from improper input validation (CWE‑20) and allows a remote authenticated user to trigger the crash.

The affected product is PocketMine‑MP, a server implementation of the Minecraft Pocket Edition protocol. All releases prior to 4.0.6 are vulnerable. The vulnerability is present in the packet handling code that processes PlayerActionPacket START_BREAK and CRACK_BREAK actions and InventoryTransactionPacket data. Administrators should verify the server is not running a pre‑4.0.6 build.

An attacker must be authenticated to the server in order to send the malicious packets, implying that compromised credentials or legitimate accounts carry the risk. The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. No public exploit has been reported, but the denial of service could disrupt servers in the absence of redundancy or fail‑over mechanisms.