Metal Gear Online 3 Stack Overflow RCE via Input Validation

Vulnerability Overview A stack buffer overflow vulnerability exists in Konami's video game Metal Gear Online 3. This vulnerability can be triggered via an input validation flaw, allowing the host to remotely execute arbitrary code on member machines. Scope of Impact Game Name: Metal Gear Online 3 Version: 1.1.2.8 CVE Number: CVE-2026-19874 Trigger Conditions: An input validation vulnerability allows the host to remotely execute arbitrary code. Remediation Remediation Status: No specific remediation is mentioned. Recommended Actions: Users are advised to update the game to the latest version or wait for an official patch from the developer. POC Code or Exploit Code No specific POC code or exploit code is provided on the page. Additional Information Original Publication Date: 2026-08-24 Last Revision Date: 2026-08-24 Vulnerability ID: VU#728712 Related Links About the Vulnerability Notice Contact Us Provide Vendor Statement Description Metal Gear Online 3 is an online competitive shooting game featuring 9 versus 8 matches, utilizing the Steam matchmaking system to handle multiplayer lobbies and games. In version 1.1.2.8 of Metal Gear Online 3 (Steam Application ID 287700), an input validation vulnerability was discovered in the processing of metadata related to player removal. The game tracks a lobby field ( ) indicating the number of players to be removed, as well as the Steam ID entries for each kicked player ( ). When a player joins a lobby, their client parses these fields to check if their own Steam ID is in the list, and if so, prevents them from joining the match. The function responsible for parsing this lobby data does not validate the value against the size of the fixed-length buffer allocated for kicked player identifiers. Providing a value larger than the buffer capacity results in writing to adjacent memory. The buffer immediately following contains internal Steamworks callback handler structures, which store function pointers and callback parameters used to process lobby data changes, messages, and other related events.

Goal Reached Thanks to every supporter — we hit 100%!

Metal Gear Online 3 Stack Overflow RCE via Input Validation