CVE-2021-48007

PocketMine-MP, a widely used PHP-based server platform for Minecraft: Bedrock Edition, fails to validate the position and rotation fields of MovePlayerPacket messages, allowing NaN or INF floating-point values to reach server-side math. Any connected client can trigger the flaw by sending a crafted movement packet containing these invalid values, causing unhandled mathematical operations that can crash the server, or making other players fail to render on clients. An attacker gains denial-of-service capability against the server and can disrupt gameplay visibility for other players; the CVSS 4.0 score of 7.1 (High) reflects a network-exploitable, low-privilege attack with high availability impact and no confidentiality or integrity impact. Operators of PocketMine-MP servers running versions before 3.18.1 are affected, along with the players on those servers. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade PocketMine-MP to 3.18.1 or later, which adds validation of NaN/INF values in MovePlayerPacket position and rotation fields. Until patched, limit connections to trusted or authenticated players and monitor for crashes or player reports of invisible players. Verify the running server version and, after updating, confirm that clients can correctly see other players.