CISA: Metal Gear Online 3 Remote Code Execution Fix Issued
2 companies named across 3 categories, one of 22 articles referencing ONLINE. Previous coverage: CISA issues update on Xerte Online Toolkits RCE vulnerabilities (Aug 2026).
Companies mentioned
Best suited for
- Seniority
- Director
- Job function
- Cybersecurity / Security Architect
- Persona
- Security Operations Leader
- Buyer role
- Decision Maker / Budget Holder
- Decision stage
- How to start
- Adoption curve
- Laggards
- Technology maturity
- Established Technology
- Industry
- Information Technology / Cybersecurity / Exposure, Risk & Governance / Vulnerability Management & Attack Surface Management
Our classification, not the publisher's statement. Best suited for, not only for.
Konami’s Metal Gear Online 3 has an input-validation issue that can lead to a heap-based buffer overflow, allowing remote code execution on affected client systems through specially crafted lobby data.
Metal Gear Online 3 is an online 8 vs. 8 competitive shooter game that uses Steam Matchmaking for multiplayer lobbies and matches. For CVE-2026-19874, version 1.1.2.8 of Metal Gear Online 3 (Steam AppID 287700) includes an input-validation vulnerability in processing Steam lobby metadata tied to the player-removal feature. The game uses a lobby field (kick_num) to indicate the number of players designated for removal and corresponding Steam ID entries (kicked_id_%i) for each kicked player. On joining a lobby, the client parses these fields to determine whether its own Steam ID is in the list, which prevents joining the match if present. The parsing function does not validate kick_num against the size of a fixed-length buffer for kicked player identifiers, so supplying a kick_num value larger than the buffer capacity causes out-of-bounds writes into adjacent memory. Immediately after this buffer are internal Steamworks callback handler structures that hold function pointers and callback arguments for processing lobby data changes, messages, and other related events. By manipulating the overflow, an attacker can corrupt these handler structures and redirect callback execution, and the vulnerability can trigger automatically when a client joins an attacker-controlled lobby.
Exploitation of this vulnerability may allow remote code execution on affected clients. Initial control-flow hijacking provides access only to existing in-process code, but the Metal Gear Online 3 binary includes Denuvo-protected regions mapped with read-write-execute (RWX) permissions, which permit runtime injection of attacker-supplied code and increase severity. An attacker hosting a lobby can achieve code execution on any client that joins without additional victim interaction. Host privileges are automatically reassigned to another lobby participant when the current host exits, enabling an attacker to obtain host control during an active match and then deliver malicious lobby data to all connected players, allowing compromise of multiple systems through a single exploitation event.
Konami has not released patch notes or an advisory that specifically addresses this vulnerability, but a fix was included in version 1.1.2.9 of the Metal Gear Online 3 executable, mgsvmgo.exe. The patch also iterated the server and lobby version numbers from 15 to 16 and from 150 to 160, respectively, to prevent players on older versions from accessing the online services. The latest patch noted as fixing the vulnerability is listed at https://steamdb.info/patchnotes/24176213/, and the full patch list is available at https://steamdb.info/app/287700/patchnotes/.
Thank you to Alice Cecchetto for reporting the vulnerability, and this document was written by Bob Kemerer.
Blog post, originally published by Bob Kemerer at kb.cert.org.