CVE-2023-54396

PocketMine-MP, a widely used third-party Minecraft Bedrock Edition server platform, fails to validate dye color IDs when deserializing banner NBT data (CWE-129, improper validation of array index). An attacker with player-level access can submit an inventory transaction or command containing an invalid banner color value, causing an undefined-offset error that crashes the server process. The impact is complete loss of availability for the affected server and all connected players; there is no confidentiality or integrity impact and no evidence of data compromise. Any operator running PocketMine-MP prior to version 4.8.1 is affected, and any publicly joinable server can be reached by any authenticated player. As of disclosure there are no known exploits, no public proof-of-concept, and the flaw is not in CISA's KEV catalog.

What to do: Upgrade PocketMine-MP to version 4.8.1 or later. If an immediate upgrade is not possible, remember the attack requires only player-level access, so any joinable server is at risk; restrict who can connect (allowlists) and monitor for crash reports involving banner or NBT deserialization. Check your deployed PocketMine-MP version against the fixed 4.8.1 release.