Executive Summary
A critical heap-based buffer overflow vulnerability has been identified in Konami's Metal Gear Online 3, tracked as CVE-2026-19874 with a CVSS score of 9.1. The flaw originates from improper validation of lobby data fields related to kicked players, enabling a remote attacker to trigger memory corruption and potentially execute arbitrary code on affected systems.
Vulnerability Details
| Field | Detail |
|---|---|
| CVE ID | CVE-2026-19874 |
| CVSS Score | 9.1 (Critical) |
| Vulnerability Type | Heap-Based Buffer Overflow (CWE-122) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Published | August 24, 2026 |
Technical Analysis
The vulnerability resides in the lobby data processing function of Metal Gear Online 3's networking subsystem. The affected function reads the lobby data key kick_num to determine how many kicked player identifiers to process, then iterates over each entry without adequate bounds validation.
Root Cause
When a malformed lobby packet is received with an inflated kick_num value, the server-side (or peer-side) processing loop copies more data into a fixed-size heap buffer than it can accommodate. This classic heap buffer overflow can lead to:
- Heap corruption overwriting adjacent memory structures
- Arbitrary code execution if the overflow overwrites function pointers or vtable entries
- Denial of service via process crash in lower-severity exploitation scenarios
Attack Surface
Metal Gear Online 3 uses a peer-to-peer lobby architecture for matchmaking and session management. Because the vulnerability involves lobby data fields processed from the network without authentication gating, an attacker within the same game session — or potentially through a spoofed lobby response — could trigger the overflow remotely with no prior authentication required.
Impact Assessment
Given the network-accessible, no-authentication attack profile and a CVSS score of 9.1, this vulnerability is rated Critical. Exploitation could allow:
- Remote code execution on the host running the vulnerable client or server component
- Session hijacking through memory manipulation of lobby state
- Credential or data theft if the compromised process has access to sensitive runtime data
While Metal Gear Online 3 is no longer an actively supported title, players running legacy versions on PC or accessing unofficial servers remain exposed.
Affected Products
| Product | Status |
|---|---|
| Metal Gear Online 3 (all versions) | Vulnerable — no vendor patch issued |
Konami has not publicly issued a patch or end-of-life advisory at the time of publication. Players are advised to treat any multiplayer sessions on unofficial servers as untrusted until further notice.
Recommendations
- Disable online multiplayer features for Metal Gear Online 3 on untrusted networks
- Firewall game traffic at the network perimeter if running on shared infrastructure
- Monitor for unusual process behavior (unexpected child processes, network connections) when running the game client
- If running unofficial servers or community-hosted infrastructure, isolate the server process in a sandboxed environment (container, VM) to limit blast radius