---
cve: "CVE-2023-54396"
severity: "HIGH"
cvss: 7.1
epss: "0.4%"
vendor: "pmmp"
kev: false
exploited: false
published: "2026-09-09 14:17:09"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-21T08:12:32+02:00"
---

# CVE-2023-54396

> 7.1 HIGH · 🧪 PoC

## Beschreibung

PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server.

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |

## Patch verfügbar (OSV)

- 0a92e91a3099a48a39f992f94071e36893e37931 (Commit)
- 08b9495bce2d65a6d1d3eeb76e484499a00765eb (Commit)

## Referenzen

- <https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wqqv-jcfr-9f5g>
- <https://github.com/pmmp/PocketMine-MP/commit/08b9495bce2d65a6d1d3eeb76e484499a00765eb>
- <https://www.vulncheck.com/advisories/pocketmine-mp-before-4.8.1-server-crash-via-banner-nbt>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2023-54396) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_