A vulnerability in Konami’s Metal Gear Online 3 allowed malicious multiplayer lobby hosts to remotely execute arbitrary code on the computers of players joining their sessions.
The flaw, tracked as CVE-2026-19874, was silently fixed earlier this month in game version 1.1.2.9.
The vulnerability was reported by security researcher Alice Cecchetto, according to a bulletin published today by Carnegie Mellon University’s CERT Coordination Center (CERT/CC). The bulletin describes the issue as a heap-based buffer overflow caused by insufficient validation of Steam lobby metadata.
Metal Gear Online 3 is the multiplayer component of Metal Gear Solid V: The Phantom Pain, Konami’s 2015 stealth-action game. Its PC multiplayer mode uses Steam Matchmaking to organize competitive 8-versus-8 matches and is distributed through Steam.
The vulnerability affects version 1.1.2.8 and originates in the game’s player-removal mechanism. Multiplayer lobbies maintain a kick_num field containing the number of players marked for removal, together with kicked_id_%i entries containing their Steam IDs.
When joining a lobby, a client processes these values to determine whether its Steam ID has been banned from the session. However, the parsing function failed to check whether kick_num exceeded the capacity of a fixed-size buffer used to store the identifiers.
A malicious host could therefore supply an oversized value and cause out-of-bounds writes into adjacent heap memory.
CERT/CC says the memory directly following the affected buffer contains Steamworks callback handler structures, including function pointers and arguments used to process lobby changes and messages. Carefully manipulating the overflow can corrupt these structures and redirect program execution.
Exploitation occurs automatically when a victim joins an attacker-controlled lobby, requiring no additional interaction.
The impact is worsened by regions of the mgsvmgo.exe process protected by Denuvo that are mapped with read-write-execute (RWX) permissions. After hijacking control flow, an attacker could use these executable memory areas to introduce and run attacker-controlled code.
An attacker could also gain host privileges after the original lobby host leaves because Metal Gear Online 3 automatically transfers hosting duties to another participant. This could allow malicious metadata to be delivered to multiple players already connected to a match.
Konami has not published an advisory specifically documenting CVE-2026-19874, but CERT/CC says the vulnerability was fixed in version 1.1.2.9. SteamDB records the corresponding Build 24176213 as released on August 4, 2026, with changes to mgsvmgo.exe, mgsvtpp.exe, mgo/chunk0.dat, and other files.
The update also changed server and lobby version numbers, preventing vulnerable older clients from accessing online services.
Players should ensure Steam has updated Metal Gear Solid V to the latest available build before using Metal Gear Online 3. Users who have disabled automatic updates should apply the current version before joining public or untrusted multiplayer lobbies.
Leave a Reply