Description

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-06T12:17:14.783Z",
  "pubdate": "2026-09-06T12:17:14.783Z",
  "executiveSummary": "PocketMine-MP versions prior to 3.18.1 contain a critical input validation vulnerability regarding floating-point handling in network packets.\nThe vulnerability type is improper input validation, specifically failing to sanitize non-finite floating-point numbers (NaN or INF) within the MovePlayerPacket protocol structure.\nImpact includes server-side application crashes due to unhandled exceptions in mathematical operations and client-side rendering failures.\nAffected systems are servers running PocketMine-MP versions before 3.18.1.\nThe risk is high as it enables unauthorized actors to disrupt service availability and compromise game-world synchronization.\nAn attacker requires network access to a vulnerable PocketMine-MP instance to transmit crafted packets.\nExploitation requires no authentication, as the malformed packet is processed by the server's network stack before authorization checks may fully mitigate the underlying logic flaws.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient validation of floating-point values provided in the MovePlayerPacket protocol. Specifically, the fields corresponding to coordinate positions (X, Y, Z) and rotation vectors (Yaw, Pitch) are processed without checking for non-finite values such as NaN (Not-a-Number) or INF (Infinity).\nIn IEEE 754 floating-point arithmetic, operations involving NaN or INF frequently lead to undefined or exceptional states when consumed by downstream game logic. When a malicious client transmits a MovePlayerPacket containing these values, the PocketMine-MP server attempts to perform spatial calculations, collision detection, or entity tracking operations using these invalid inputs.\nThe attack flow proceeds as follows: 1) The attacker constructs a custom MovePlayerPacket containing IEEE 754 representations for NaN or INF in the movement or rotation fields. 2) The packet is sent to the server over the network. 3) The server's packet handler deserializes the packet and updates the player's internal state. 4) The server-side physics engine or entity manager processes these values in vector arithmetic. 5) This triggers either a CPU exception, an unhandled logic error, or a state corruption, resulting in the termination of the server process or the invalidation of the affected entity's spatial state.\nThis vulnerability is particularly impactful because it affects the server's ability to maintain a consistent game state. Beyond crashing the server, if the invalid data is propagated to other connected clients, it causes rendering failures where the affected player's character model becomes corrupted or invisible to other users due to the inability of the client-side engine to transform the non-finite coordinates into valid screen-space pixels.\nThe vulnerability is present in the packet handling routines for the MovePlayerPacket protocol in all PocketMine-MP versions below 3.18.1. Exploitation is facilitated by the fact that the server performs these sensitive mathematical operations before strictly validating the incoming data, effectively bypassing intended bounds checks for standard coordinates."
}