CVE-2025-31488 Other in PCL2
Attackers can force the launcher to load malicious webpages via Internet Explorer controls, bypassing intended security restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-31488?
CVE-2025-31488 is a medium-severity vulnerability in Hex-Dragon PCL2, published on 6 Apr 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Plain Craft Launcher (PCL) is a launcher for Minecraft. PCL allows users to use homepages provided by third parties. If controls such as WebBrowser are used in the homepage, WPF will use Internet Explorer to load the specified webpage. If the user uses a malicious homepage, the attacker can use IE background to access the specified webpage without knowing it. This vulnerability is fixed in 2.9.3.
Weakness: CWE-20
Which versions are affected by CVE-2025-31488?
How do I fix CVE-2025-31488?
No fix has been published for CVE-2025-31488 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-31488 being exploited?
There is no known exploitation of CVE-2025-31488 in the wild and no public exploit code.
Sources
Also known as GHSA-wfpw-hfcp-9m73.