The reported vulnerability resides in the handling of BookEditPacket messages. When an attacker sends a packet containing an invalid inventory slot value greater than 35, PocketMine‑MP fails to validate the input and throws an unhandled exception. This causes the server process to terminate, resulting in a denial‑of‑service scenario. The flaw is a classic example of unsafe input handling identified as CWE‑20. It does not permit data exfiltration or code execution.

The issue affects the PocketMine‑MP server component, specifically versions released before 5.11.2. All installations of pmmp PocketMine‑MP that have not applied the 5.11.2 update are vulnerable.

The CVSS score of 7.1 indicates a medium‑high severity. The EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploitation at this time. Attackers only need network access to the server and the ability to send a crafted BookEditPacket; no authentication or privileged privileges are required. The exploit path is straightforward, making it a realistic risk for any publicly exposed PocketMine‑MP server.