Executive brief
PocketMine-MP is a server software for the Minecraft Bedrock Edition multiplayer experience. The software fails to validate dye color IDs when processing banner item data, allowing an authenticated attacker to provide malformed data that crashes the game server. This denies service to all players on the affected server.
Technical details
The vulnerability is an improper input validation flaw in the DyeColorIdMap class, specifically the fromId() method, which does not check whether a provided dye color ID exists in the internal mapping before accessing it. The vulnerable code path is triggered during Banner item deserialization (Banner::deserializeCompoundTag()), which processes NBT data from network inventory transactions or /give commands. An attacker with low privileges (able to send inventory transactions or execute commands) can supply invalid color values in banner NBT data, causing an undefined offset error that crashes the server. The fix, deployed in version 4.8.1, adds null coalescing to safely handle invalid IDs. Patch available: commit 08b9495.
Affected products
- PocketMine PocketMine-MP before 4.8.1
Timeline
- 2023-01-06: disclosed
- 2023-01-06: patched: Version 4.8.1 released with fix
- 2026-09-09: advisory: CVE-2023-54396 published