CVE-2026-19874: Metal Gear Online 3 Buffer Overflow Vulnerability

CVE-2026-19874 Overview

CVE-2026-19874 is a heap-based buffer overflow [CWE-122] in Konami's Metal Gear Online 3. The flaw resides in the lobby data handler that processes the list of kicked players. The affected function reads the kick_num lobby key to determine iteration count and then reads kicked_id_%i entries into a fixed-size buffer sized for the game's 16-player match limit. Because kick_num is never validated against this bound, an attacker-controlled value causes writes past the buffer and into adjacent Steam callback handler structures. Overwriting function pointers within those structures can hijack control flow inside the game process.

Critical Impact
A remote attacker can send crafted lobby metadata to overwrite Steam callback function pointers and potentially achieve arbitrary code execution within the Metal Gear Online 3 process.

Affected Products

Konami Metal Gear Online 3
Steam-integrated multiplayer lobby component
Client instances processing lobby data updates

Discovery Timeline

2026-08-24 - CVE-2026-19874 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-19874

Vulnerability Analysis

The vulnerable routine handles kicked-player metadata delivered through Steam lobby data. It reads the integer stored under the kick_num key, then iterates that many times, reading each kicked_id_%i value and copying the identifier into a static-sized heap buffer. The buffer is sized for the maximum supported match roster of 16 players. No bounds check confirms that kick_num is less than or equal to the buffer capacity. When the attacker specifies a larger value, writes proceed linearly past the buffer edge into the heap regions that follow.

Those adjacent regions hold Steam callback handler structures used by the game to dispatch lobby data updates, lobby chat messages, and related events. The overwrite is deterministic in layout, giving an attacker precise control over which handler fields are corrupted.

Root Cause

The root cause is missing input validation on an attacker-supplied length field. The function trusts the kick_num value from lobby metadata as authoritative and does not clamp it to the 16-entry buffer capacity. This pattern is a classic instance of CWE-122: Heap-based Buffer Overflow, where the count controlling a copy loop is not reconciled with destination size.

Attack Vector

Exploitation occurs over the network through the Steam lobby channel. An attacker with the ability to publish lobby data — typically the lobby owner or a peer with write access to lobby fields — sets kick_num to a value exceeding 16 and supplies corresponding kicked_id_%i fields. When a victim client joins or receives a lobby data update, the vulnerable handler processes the fields and writes attacker-controlled data over adjacent callback structures. Overwriting a function pointer and its associated argument field enables control-flow hijacking on the next callback dispatch. No authentication to the game vendor is required beyond joining the lobby, and no user interaction beyond normal multiplayer participation is needed. See CERT Vulnerability ID #728712 for coordinated disclosure details.

Detection Methods for CVE-2026-19874

Indicators of Compromise

Steam lobby data containing a kick_num value greater than 16, which exceeds the game's supported roster size.
Presence of kicked_id_%i keys with indexes at or above 16 in captured lobby metadata.
Metal Gear Online 3 process crashes with heap corruption or access violations shortly after receiving a lobby data update.
Unexpected child processes or outbound connections originating from the game executable following lobby join events.

Detection Strategies

Inspect Steam lobby telemetry for oversized kick_num fields and out-of-range kicked_id_%i indexes.
Monitor endpoints running Metal Gear Online 3 for Watson or WER crash reports referencing heap corruption in the lobby handler.
Correlate game process anomalies (unexpected memory allocations, thread creation, code execution from writable heap pages) with recent lobby activity.

Monitoring Recommendations

Enable process-level behavioral monitoring on gaming endpoints to identify post-exploitation activity such as shell spawns or credential access from the game process.
Retain network flow and Steam client logs to reconstruct lobby membership around suspected exploitation events.
Alert on Metal Gear Online 3 processes performing actions outside their normal behavior baseline, including file writes to user profile directories and outbound connections to non-Steam infrastructure.

How to Mitigate CVE-2026-19874

Immediate Actions Required

Avoid joining untrusted Metal Gear Online 3 lobbies until a vendor patch is available.
Restrict multiplayer participation to closed sessions with known peers to reduce exposure to hostile lobby owners.
Monitor Konami and Steam channels for a security update addressing the lobby data handler.

Patch Information

At the time of NVD publication on 2026-08-24, no vendor patch reference is listed in the CVE record. Refer to CERT Vulnerability ID #728712 and Konami's official channels for the authoritative patch status and remediation guidance.

Workarounds

Play only in private lobbies whose owner and members are trusted.
Terminate the game process immediately if the client becomes unresponsive after a lobby data update.
Run the game under a standard (non-administrative) user account to limit the scope of any successful control-flow hijack.

bash

# No vendor-provided configuration mitigation is available.
# Refer to CERT VU#728712 for updates: https://kb.cert.org/vuls/id/728712