CVE-2026-19874
Received Received - Intake

Heap Overflow in Metal Gear Online 3

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: CERT/CC

Description
A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kick_num" to determine the number of entries, and individual kicked player IDs supplied via keys in the format "kicked_id_%i". The function does not validate that "kick_num" falls within the expected bounds. The game design limits matches to a maximum of 16 players, and the corresponding buffer for storing kicked player IDs is sized accordingly. If "kick_num" exceeds this limit, the function continues writing the provided player IDs past the end of the intended buffer and into adjacent memory regions. These adjacent regions contain Steam callback handler structures responsible for processing lobby data updates, lobby messages, and other related events. By supplying an oversized "kick_num" value and appropriate "kicked_id_%i" fields, an attacker can overwrite fields within the callback handler structures, including function pointers and callback argument values. Successful exploitation may enable control-flow hijacking, potentially allowing arbitrary code execution within the game process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-19874
EUVD
EUVD-2026-64916

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
konami metal_gear_online_3 1.1.2.8
konami metal_gear_online_3 1.1.2.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19874 is a heap-based buffer overflow in Konami's Metal Gear Online 3 version 1.1.2.8. It occurs when processing lobby data for kicked players. The game uses a kick_num field to track removed players and stores their Steam IDs in a fixed-size buffer. If kick_num exceeds the buffer limit, the game writes beyond allocated memory into adjacent Steam callback handler structures. This allows overwriting function pointers and callback arguments, enabling control-flow hijacking and potential arbitrary code execution on client systems.

Detection Guidance

This vulnerability is specific to Konami's Metal Gear Online 3 game client and requires examining the game's memory or network traffic during lobby interactions. No standard network or system commands can directly detect this issue as it involves game-specific memory corruption. Monitor for crashes or unusual behavior when joining lobbies, particularly those with large kick_num values or unexpected player removal lists.

Impact Analysis

If you play Metal Gear Online 3 version 1.1.2.8, an attacker could exploit this vulnerability by hosting a malicious lobby. When you join, the game may automatically execute attacker-controlled code on your system. This could allow the attacker to take control of your game client, potentially stealing data or performing other malicious actions. The attack requires no further interaction from you beyond joining the lobby.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a video game client-side buffer overflow issue. Standards like GDPR focus on data protection and privacy, while HIPAA addresses healthcare data security. This CVE involves memory corruption in a game client, not data handling or privacy violations.

Mitigation Strategies

Update Metal Gear Online 3 to version 1.1.2.9 or later, which includes the patch for this vulnerability. Avoid joining untrusted lobbies, especially those with suspicious kick_num values or player removal lists. If automatic updates are unavailable, manually install the patched executable mgsvmgo.exe and ensure server/lobby version numbers are updated to 16/160 respectively.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19874. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart