Time-of-check Time-of-use (TOCTOU) Race Condition in PocketMine-MP - CVE-2026-86203
Published: April 8, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU125430
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-86203
CWE-ID: CWE-367
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to duplicate items and XP drops.
The vulnerability exists due to improper state validation in the entity attack handler when processing attack packets for entities marked for despawn. A remote attacker can send a timed attack against a player entity during disconnect handling to duplicate items and XP drops.
Exploitation requires precise timing during the short interval after the target player has initiated disconnect and before the entity is removed from the world's entity table.
Affected software
PocketMine-MP
How to mitigate CVE-2026-86203
Install security update from vendor's website.
PocketMine-MP - update to 5.39.2