CVE-2022-23884: Minecraft Bedrock Server

Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days.

Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::_read (packet deserializer).

Affected products

• Minecraft Bedrock Server: version 1.18.2 only

Published 2022-03-28. Last modified 2026-06-17.