CVE-2026-19874: Critical Heap Buffer Overflow in Metal Gear Online 3

Executive Summary

A critical heap-based buffer overflow vulnerability has been identified in Konami's Metal Gear Online 3, tracked as CVE-2026-19874 with a CVSS score of 9.1. The flaw originates from improper validation of lobby data fields related to kicked players, enabling a remote attacker to trigger memory corruption and potentially execute arbitrary code on affected systems.

Vulnerability Details

Technical Analysis

The vulnerability resides in the lobby data processing function of Metal Gear Online 3's networking subsystem. The affected function reads the lobby data key kick_num to determine how many kicked player identifiers to process, then iterates over each entry without adequate bounds validation.

Root Cause

When a malformed lobby packet is received with an inflated kick_num value, the server-side (or peer-side) processing loop copies more data into a fixed-size heap buffer than it can accommodate. This classic heap buffer overflow can lead to:

• Heap corruption overwriting adjacent memory structures
• Arbitrary code execution if the overflow overwrites function pointers or vtable entries
• Denial of service via process crash in lower-severity exploitation scenarios

Attack Surface

Metal Gear Online 3 uses a peer-to-peer lobby architecture for matchmaking and session management. Because the vulnerability involves lobby data fields processed from the network without authentication gating, an attacker within the same game session — or potentially through a spoofed lobby response — could trigger the overflow remotely with no prior authentication required.

Impact Assessment

Given the network-accessible, no-authentication attack profile and a CVSS score of 9.1, this vulnerability is rated Critical. Exploitation could allow:

1. Remote code execution on the host running the vulnerable client or server component
2. Session hijacking through memory manipulation of lobby state
3. Credential or data theft if the compromised process has access to sensitive runtime data

While Metal Gear Online 3 is no longer an actively supported title, players running legacy versions on PC or accessing unofficial servers remain exposed.

Affected Products

Konami has not publicly issued a patch or end-of-life advisory at the time of publication. Players are advised to treat any multiplayer sessions on unofficial servers as untrusted until further notice.

Recommendations

• Disable online multiplayer features for Metal Gear Online 3 on untrusted networks
• Firewall game traffic at the network perimeter if running on shared infrastructure
• Monitor for unusual process behavior (unexpected child processes, network connections) when running the game client
• If running unofficial servers or community-hosted infrastructure, isolate the server process in a sandboxed environment (container, VM) to limit blast radius

References

• NVD — CVE-2026-19874