CVE-2026-86203 Overview
CVE-2026-86203 affects PocketMine-MP, an open-source server software for Minecraft: Bedrock Edition. Versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers exploit a race condition by attacking a disconnecting player to trigger multiple death handlers. This causes inventory items and experience orbs to drop multiple times, enabling item duplication on affected servers. The flaw is tracked as an improper control of a resource through its lifetime issue [CWE-664].
Critical Impact
A network-based race condition allows attackers to duplicate in-game items and experience by attacking disconnecting players, undermining server economy integrity.
Affected Products
- PocketMine-MP versions before 5.39.2
- Minecraft: Bedrock Edition server deployments using PocketMine-MP
- Any downstream forks or distributions that embed vulnerable PocketMine-MP releases
Discovery Timeline
- 2026-09-09 - CVE-2026-86203 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86203
Vulnerability Analysis
The vulnerability is a race condition in how PocketMine-MP handles entity lifecycle transitions. When a player disconnects, the entity remains in the world entity table pending despawn. During this transient window, incoming attack packets from other clients are still processed against the disconnecting player entity. Because the death handler is not idempotent and does not check the despawn flag, repeated attacks trigger it multiple times. Each invocation drops the player's inventory and experience orbs, yielding duplicated items in the world.
Root Cause
The root cause is missing state validation on entities flagged for despawn. Code paths such as sign editors and experience orb targeting resolved player entities via getEntity() without checking isConnected() or isFlaggedForDespawn(). The death handler could therefore fire on a player entity that had already begun teardown, violating the resource lifecycle contract described by [CWE-664].
Attack Vector
Exploitation requires network access to a PocketMine-MP server and the ability to send attack packets against another player. An attacker times attack packets to strike a target during the narrow window between disconnect and full entity removal. Because the timing window is small, exploitation is probabilistic and requires repeated attempts, matching the high attack complexity of the vulnerability.
// Security patch in src/block/BaseSign.php
$player = $this->editorEntityRuntimeId !== null ?
$this->position->getWorld()->getEntity($this->editorEntityRuntimeId) :
null;
- if($player instanceof Player){
+ //TODO: HACK! We really shouldn't be keeping disconnected players (and generally flagged-for-despawn entities)
+ //in the world's entity table, but changing that is too risky for a hotfix. This workaround will do for now.
+ if($player instanceof Player && $player->isConnected()){
$player->openSignEditor($this->position);
}
}
// Security patch in src/entity/object/ExperienceOrb.php
$entity = $this->getWorld()->getEntity($this->targetPlayerRuntimeId);
- if($entity instanceof Human){
+ if($entity instanceof Human && !$entity->isFlaggedForDespawn()){
return $entity;
}
Source: GitHub Commit c0719b76
Detection Methods for CVE-2026-86203
Indicators of Compromise
- Multiple identical inventory drop events tied to a single player death event in server logs.
- Experience orb spawns exceeding expected counts for a player death, especially on players who recently disconnected.
- Attack packets targeting a player whose session is in the disconnecting state.
- Sudden growth in server-side item inventories inconsistent with normal gameplay progression.
Detection Strategies
- Audit PocketMine-MP server logs for repeated PlayerDeathEvent invocations associated with the same runtime entity ID.
- Correlate disconnect events with inbound attack packets processed within the same tick window.
- Instrument the death handler to log stack traces when triggered against entities flagged for despawn.
Monitoring Recommendations
- Track PocketMine-MP release versions across managed hosts and flag any instance below 5.39.2.
- Enable verbose logging on entity lifecycle transitions to surface handler invocations on stale entities.
- Monitor economy metrics such as total server-wide item counts for anomalous growth indicative of duplication.
How to Mitigate CVE-2026-86203
Immediate Actions Required
- Upgrade PocketMine-MP to version 5.39.2 or later on all affected servers.
- Review the GitHub Security Advisory GHSA-f9jp-856v-8642 for authoritative guidance.
- Roll back suspected duplicated inventories using server backups taken before the patch window.
Patch Information
The fix is delivered in PocketMine-MP 5.39.2 through commit c0719b76. The patch adds isConnected() and isFlaggedForDespawn() checks in code paths that resolve player entities from the world entity table, preventing action handlers from firing on entities pending teardown. See the GitHub Commit c0719b76 and the VulnCheck Advisory on PocketMine-MP for technical detail.
Workarounds
- Restrict server access to trusted players via whitelist until the upgrade is applied.
- Disable or rate-limit player-versus-player combat on public servers running vulnerable versions.
- Increase server tick monitoring and terminate sessions exhibiting rapid attack packet bursts against disconnecting targets.
# Verify installed PocketMine-MP version and upgrade
php -r "require 'vendor/autoload.php'; echo \\pocketmine\\VersionInfo::BASE_VERSION.PHP_EOL;"
# Fetch fixed release
wget https://github.com/pmmp/PocketMine-MP/releases/download/5.39.2/PocketMine-MP.phar
# Restart the server after replacing the phar
systemctl restart pocketmine-mp
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
