CISA: Metal Gear Online 3 Remote Code Execution Fix Issued
Konami’s Metal Gear Online 3 has an input-validation issue that can lead to a heap-based buffer overflow, allowing remote code execution on affected client systems through specially crafted lobby data.
Metal Gear Online 3 is an online 8 vs. 8 competitive shooter game that uses Steam Matchmaking for multiplayer lobbies and matches. For CVE-2026-19874, version 1.1.2.8 of Metal Gear Online 3 (Steam AppID 287700) includes an input-validation vulnerability in processing Steam lobby metadata tied to the player-removal feature. The game uses a lobby field (kick_num) to indicate the number of players designated for removal and corresponding Steam ID entries (kicked_id_%i) for each kicked player. On joining a lobby, the client parses these fields to determine whether its own Steam ID is in the list, which prevents joining the match if present. The parsing function does not validate kick_num against the size of a fixed-length buffer for kicked player identifiers, so supplying a kick_num value larger than the buffer capacity causes out-of-bounds writes into adjacent memory. Immediately after this buffer are internal Steamworks callback handler structures that hold function pointers and callback arguments for processing lobby data changes, messages, and other related events. By manipulating the overflow, an attacker can corrupt these handler structures and redirect callback execution, and the vulnerability can trigger automatically when a client joins an attacker-controlled lobby.
Exploitation of this vulnerability may allow remote code execution on affected clients. Initial control-flow hijacking provides access only to existing in-process code, but the Metal Gear Online 3 binary includes Denuvo-protected regions mapped with read-write-execute (RWX) permissions, which permit runtime injection of attacker-supplied code and increase severity. An attacker hosting a lobby can achieve code execution on any client that joins without additional victim interaction. Host privileges are automatically reassigned to another lobby participant when the current host exits, enabling an attacker to obtain host control during an active match and then deliver malicious lobby data to all connected players, allowing compromise of multiple systems through a single exploitation event.
Konami has not released patch notes or an advisory that specifically addresses this vulnerability, but a fix was included in version 1.1.2.9 of the Metal Gear Online 3 executable, mgsvmgo.exe. The patch also iterated the server and lobby version numbers from 15 to 16 and from 150 to 160, respectively, to prevent players on older versions from accessing the online services. The latest patch noted as fixing the vulnerability is listed at https://steamdb.info/patchnotes/24176213/, and the full patch list is available at https://steamdb.info/app/287700/patchnotes/.
Thank you to Alice Cecchetto for reporting the vulnerability, and this document was written by Bob Kemerer.
Source: kb.cert.org, by Bob Kemerer.