A critical vulnerability in PocketMine-MP allows unauthenticated remote attackers to crash game servers by sending malformed skin geometry packets.

The application fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. An unauthenticated attacker can exploit this by sending specially crafted login or skin packets to trigger an unhandled RuntimeException, resulting in an immediate server crash.

The exploitation of this vulnerability results in a denial of service, which leads to significant system downtime and service unavailability for users. Given the CVSS score of 7.5, this high-severity flaw poses a direct threat to operational continuity, potentially disrupting community activities and requiring administrative intervention to restore service.

Immediate Action: Update the PocketMine-MP installation to version 4.7.2 or later to include the necessary exception handling logic.

Proactive Monitoring: Monitor server logs for repeated connection drops or errors related to packet parsing, which may indicate attempted exploitation.

Compensating Controls: If immediate patching is not feasible, restrict server access to known trusted IP addresses or implement packet filtering to block malformed JSON payloads at the network edge.

Public Exploit Available: No (exploit_available: unknown)

The vulnerability represents a clear risk to server stability due to the potential for unauthenticated remote crashes. Administrators must prioritize the update to version 4.7.2 immediately to ensure the integrity and availability of their PocketMine-MP deployments.