PocketMine‑MP servers that are running versions older than 3.26.5 or 4.0.5 accept skin data sent by players without checking its length. Because the skinID or geometryName strings can be arbitrarily large, they can exceed the 32,767 byte limit for a TAG_String. When the game attempts to serialize this oversized NBT data, an exception is thrown that crashes the server, interrupting service for all connected players.

The vulnerability impacts the PocketMine‑MP server software. Versions prior to 3.26.5 and 4.0.5 are affected; the recent releases include input validation that mitigates the issue.

The CVSS score of 8.7 marks this flaw as high severity. No EPSS score is available at this time, so the probability of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the crash by sending a crafted skin packet from a remote client, making the attack vector network‑based and easily exploitable without privileged access. The outcome is a server crash that results in denial of service for all users.