PocketMine-MP CVE-2026-86203

Exploitation requires two human players on the same server: the victim (Player A) must be at exactly 1 HP so a single hit kills them, and must initiate a disconnect sequence (click 'Disconnect' or 'Exit to Menu'). The attacker (Player B) must be in melee range and successfully land an attack within a split-second window after Player A's disconnect begins but before the server completes entity removal. The attack is limited to multiplayer servers running PocketMine-MP before 5.39.2, requires in-game proximity (melee range), and cannot be scripted against arbitrary targets - it requires social engineering or monitoring of target HP and disconnect behavior. Default server configurations are vulnerable; no special plugin or mode must be enabled.

The CVSS 4.0 score of 6.3 with AV:N/AC:H/AT:P/PR:N/UI:N is an accurate reflection of real-world risk. The AC:H and AT:P ratings are substantive constraints: exploitation requires two coordinated players and a split-second timing window during disconnection, making reliable, automated exploitation difficult. The impact is purely a game-economy integrity issue (VI:L) with no confidentiality or server-availability consequences, which is appropriate for a duplication bug on a Minecraft server. No EPSS score is provided in the input data. No KEV listing exists, and there is no evidence of active exploitation beyond the published advisory PoC. For survival-mode Minecraft servers where economy integrity is a design goal, this is a meaningful griefing/cheating risk. For servers where item economy is not enforced, impact is negligible. The publicly available exploit lowers the barrier for any player on a vulnerable server to attempt the attack, raising practical risk for operators who have not patched.

Player B, aware of the vulnerability, waits until Player A (at 1 HP with valuable inventory) begins the disconnect sequence by clicking 'Exit to Menu'. Within the split-second timing window before the server removes Player A's entity from the world table, Player B sends an attack packet killing Player A, triggering the death handler on the still-accessible but flaggedForDespawn entity, causing inventory and XP to drop. Player A reconnects with their full inventory intact, while Player B collects the duplicated drops. The GitHub Security Advisory includes exact reproduction steps constituting a functional proof-of-concept.