Konami Metal Gear Online 3 1.1.2.8 Lobby Data Processing kick_num/kicked_id_%i heap-based overflow

Summaryinfo

A vulnerability was found in Konami Metal Gear Online 3 1.1.2.8. It has been declared as critical. The affected element is an unknown function of the component Lobby Data Processing. Executing a manipulation of the argument kick_num/kicked_id_%i can lead to heap-based overflow. This vulnerability appears as CVE-2026-19874. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability has been found in Konami Metal Gear Online 3 1.1.2.8 and classified as critical. This vulnerability affects some unknown processing of the component Lobby Data Processing. The manipulation of the argument kick_num/kicked_id_%i with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kick_num" to determine the number of entries, and individual kicked player IDs supplied via keys in the format "kicked_id_%i". The function does not validate that "kick_num" falls within the expected bounds. The game design limits matches to a maximum of 16 players, and the corresponding buffer for storing kicked player IDs is sized accordingly. If "kick_num" exceeds this limit, the function continues writing the provided player IDs past the end of the intended buffer and into adjacent memory regions. These adjacent regions contain Steam callback handler structures responsible for processing lobby data updates, lobby messages, and other related events. By supplying an oversized "kick_num" value and appropriate "kicked_id_%i" fields, an attacker can overwrite fields within the callback handler structures, including function pointers and callback argument values. Successful exploitation may enable control-flow hijacking, potentially allowing arbitrary code execution within the game process.

This vulnerability was named CVE-2026-19874 since 08/14/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/24/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Konami

Name

• Metal Gear Online 3

Version

• 1.1.2.8

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion