PocketMine-MP EUVD-2026-74913

Exploitation requires the attacker to hold a valid authenticated session on the PocketMine-MP server (CVSS PR:L) and to be positioned so that other active players fall within the server's entity visibility radius - the more visible players, the greater the amplification. No special server configuration or elevated permissions are needed beyond standard player access; the vulnerable ActorEventPacket handler is active in all default installations before 5.39.2. The impact is negligible on servers with few concurrent players and grows substantially on crowded public servers. No admin-level access, non-default settings, or specific platform is required.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, score 5.3 Medium) accurately reflects the low-privilege authenticated requirement and network reachability. The VI:L integrity dimension in the provided vector is debatable - the primary real-world impact is resource exhaustion (CPU and memory waste on the server plus animation spam to peer clients) rather than a meaningful integrity change, suggesting a slight framing mismatch in the vendor-supplied metrics. The amplification effect scales with server population, meaning crowded public servers face proportionally worse impact. A publicly available exploit reference exists via the GitHub security advisory (GHSA-7hmv-4j2j-pp6f), which lowers the exploitation barrier to any registered player. No EPSS score was provided in the input data and no CISA KEV listing exists, consistent with this being a moderate-severity gaming-server nuisance rather than a critical enterprise threat. Any server operator running PocketMine-MP without rate-limiting plugins should prioritize upgrading, since the patch is a clean architectural fix with no functional trade-offs.

An attacker registers a player account on a PocketMine-MP server and positions their character within view of many other players, then floods the server with crafted ActorEventPacket EATING_ITEM messages. The server rebroadcasts a consuming animation to every visible peer for each packet received, amplifying the attacker's bandwidth by a factor equal to the number of visible players and steadily exhausting server CPU and memory. A publicly available exploit reference via the GitHub advisory lowers the effort required.