Description
PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server.
Published: 2026-09-09
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability in PocketMine-MP allows attackers to submit banner NBT data that contains invalid dye color IDs during deserialization. The server does not validate these IDs and consequently triggers undefined offset errors that crash the server, causing a denial of service to all connected players.

Affected Systems

PocketMine-MP versions prior to 4.8.1 are affected. Users running pmmp: PocketMine-MP before 4.8.1 are vulnerable. No additional vendor or product information is provided.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity vulnerability. EPSS information is not available, so the exact likelihood of exploitation remains unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote, with attackers able to trigger the crash through player inventory transactions or server commands.

Generated by OpenCVE AI on September 9, 2026 at 14:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update PocketMine-MP to version 4.8.1 or later to apply the patch that validates banner NBT data.
  • Restrict server access by configuring firewall rules to allow only trusted IP addresses if an immediate update is not possible.
  • Disable or limit commands that allow banner manipulation until a patch is available to prevent attackers from sending malicious NBT payloads.
  • Monitor server logs for crash entries or exception traces that indicate the use of invalid banner data, and investigate any suspicious activity promptly.

Generated by OpenCVE AI on September 9, 2026 at 14:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 09 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
Description PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server.
Title PocketMine-MP before 4.8.1 Server Crash via Banner NBT
Weaknesses CWE-129
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-09T14:10:48.619Z

Reserved: 2026-09-05T21:00:50.888Z

Link: CVE-2023-54396

cve-icon Vulnrichment

Updated: 2026-09-09T14:10:44.203Z

cve-icon NVD

Status : Received

Published: 2026-09-09T14:17:09.883

Modified: 2026-09-09T15:17:05.607

Link: CVE-2023-54396

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-09T14:45:05Z

Weaknesses
  • CWE-129

    Improper Validation of Array Index