{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/728712#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nKonami's Metal Gear Online 3 video game contains a heap-based buffer overflow that can be triggered by an input‑validation vulnerability that allows match hosts to remotely execute arbitrary code on lobby members' machines through specially crafted data.\r\n\r\n### Description\r\nMetal Gear Online 3 is an online 8 vs. 8 competitive shooter game that uses Steam Matchmaking to handle its multiplayer lobbies and matches. As detailed in ***CVE‑2026‑19874***, version 1.1.2.8 of Metal Gear Online 3 (Steam AppID 287700) contains an input‑validation vulnerability in the processing of Steam lobby metadata related to the player‑removal feature. The game tracks a lobby field (`kick_num`) indicating the number of players designated for removal, along with corresponding Steam ID entries of each kicked player (`kicked_id_%i`). When joining a lobby, the player's client parses these fields to check whether its own Steam ID is on the list, and if so, the player is prevented from joining the match. \r\n\r\nThe function responsible for parsing this lobby data does not validate the `kick_num` value against the size of the fixed‑length buffer allocated for kicked player identifiers. Supplying a `kick_num` value larger than the buffer capacity results in out‑of‑bounds writes into adjacent memory. The memory region immediately following this buffer contains internal Steamworks callback handler structures that store function pointers and callback arguments for processing lobby data changes, messages, and other related events. By manipulating the overflow, an attacker can corrupt these handler structures and redirect callback execution, resulting in control‑flow hijacking on affected client systems. The vulnerability can be triggered automatically when a client joins a lobby controlled by an attacker.\r\n\r\n### Impact\r\nExploitation of this vulnerability may allow remote code execution on affected clients. Initial control‑flow hijacking provides access only to existing in‑process code; however, the Metal Gear Online 3 binary includes Denuvo‑protected regions mapped with read‑write‑execute (RWX) permissions. These regions permit runtime injection of attacker‑supplied code, significantly increasing the severity of the issue. An attacker hosting a lobby can achieve code execution on any client that joins, without requiring further interaction from the victim. Additionally, because host privileges are automatically reassigned to another lobby participant when the current host exits, an attacker can obtain host control during an active match and subsequently deliver the malicious lobby data to all connected players. This enables compromise of multiple systems through a single exploitation event.\r\n\r\n### Solution\r\nAs of this writing, Konami has not released patch notes or an advisory that specifically addresses this vulnerability, but a fix was included in version 1.1.2.9 of the Metal Gear Online 3 executable, `mgsvmgo.exe`. The patch also iterated the server and lobby version numbers from 15 to 16 and 150 to 160, respectively, to prevent players on older versions from accessing the online services.\r\n\r\nThis is the latest patch that fixed the vulnerability:\r\nhttps://steamdb.info/patchnotes/24176213/\r\n\r\nThe full patch list can be found here:\r\nhttps://steamdb.info/app/287700/patchnotes/\r\n\r\n### Acknowledgements\r\nThank you to Alice Cecchetto for reporting this vulnerability. This document was written by Bob Kemerer.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/728712"},{"url":"https://cwe.mitre.org/data/definitions/122.html","summary":"https://cwe.mitre.org/data/definitions/122.html"},{"url":"https://store.steampowered.com/app/287700/METAL_GEAR_SOLID_V_THE_PHANTOM_PAIN/","summary":"https://store.steampowered.com/app/287700/METAL_GEAR_SOLID_V_THE_PHANTOM_PAIN/"},{"url":"https://steamdb.info/app/287700/","summary":"https://steamdb.info/app/287700/"},{"url":"https://steamdb.info/patchnotes/24176213/","summary":"https://steamdb.info/patchnotes/24176213/"}],"title":"Konami's Metal Gear Online 3 contains a heap-based buffer overflow","tracking":{"current_release_date":"2026-08-24T15:03:10+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.45"}},"id":"VU#728712","initial_release_date":"2026-08-24 14:57:41.637135+00:00","revision_history":[{"date":"2026-08-24T15:03:10+00:00","number":"1.20260824150310.2","summary":"Released on 2026-08-24T15:03:10+00:00"}],"status":"final","version":"1.20260824150310.2"}},"vulnerabilities":[{"title":"A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players.","notes":[{"category":"summary","text":"A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key \"kick_num\" to determine the number of entries, and individual kicked player IDs supplied via keys in the format \"kicked_id_%i\". The function does not validate that \"kick_num\" falls within the expected bounds. The game design limits matches to a maximum of 16 players, and the corresponding buffer for storing kicked player IDs is sized accordingly. If \"kick_num\" exceeds this limit, the function continues writing the provided player IDs past the end of the intended buffer and into adjacent memory regions. These adjacent regions contain Steam callback handler structures responsible for processing lobby data updates, lobby messages, and other related events. By supplying an oversized \"kick_num\" value and appropriate \"kicked_id_%i\" fields, an attacker can overwrite fields within the callback handler structures, including function pointers and callback argument values. Successful exploitation may enable control-flow hijacking, potentially allowing arbitrary code execution within the game process."}],"cve":"CVE-2026-19874","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#728712"}]}],"product_tree":{"branches":[]}}