CVE-2026-86203CWE-664

CVE-2026-86203

Low · published September 9, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
27.2
In the wild
Unconfirmed
What it is

PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for duplication.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00348 · 27.2th percentile
Weakness
CWE-664 · Improper Control of a Resource Through its Lifetime
Published
2026-09-09T18:17Z
References (3)
https://github.com/pmmp/PocketMine-MP/commit/c0719b76b18f2508143134e79bc9f1aa39109683 · [email protected]https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-f9jp-856v-8642 · [email protected]https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-item-duplication-via-despawn-state · [email protected]
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 13:32Z
    PocketMine-MP before 5.39.2 Item Duplication via Despawn State
    cvelistv5