CVE-2023-54396

PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server.

Scoring

Severity

HIGH

CVSS base score

7.1

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-129

Published

2026-09-09

Last modified

2026-09-09

Affected products

• pmmp PocketMine-MP
• pmmp PocketMine-MP

Weakness type

• CWE-129

Related vulnerabilities

• CVE-2026-87500 — Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a...
• CVE-2026-0799 — OOBR and OOBW in libpcap before 1.10.7
• CVE-2026-57159 — PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance
• CVE-2026-85084 — Out-of-bounds write in TizenFX MediaBufferBase indexer setter due to missing bounds check
• CVE-2023-31308 — A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial...
• CVE-2026-82327 — Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data
• CVE-2026-19318 — Fireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code Execution
• CVE-2026-79775 — rclone Archive Backend SquashFS Parser Denial of Service

Markdown version · Browse all CVEs