Do Son 
Konami recently patched a critical Metal Gear Online 3 RCE vulnerability that allowed attackers to hijack client systems. Attackers exploited a heap-based buffer overflow in the lobby metadata to execute malicious code on players’ machines. Therefore, users must update to the newest game version immediately to ensure their systems remain secure.
- CVE: CVE-2026-19874
- CVSS: 9.1 (Critical · CVSSv3)
- Product: Konami Metal Gear Online 3
- Affected: 1.1.2.8
- Impact: Konami's Metal Gear Online 3 contains a heap-based buffer overflow
- Status: No confirmed exploitation yet
- Action: See vendor advisory
Why This Matters
This Metal Gear Online 3 RCE flaw presents a severe risk to gamers worldwide. The game binary maps Denuvo-protected memory regions with read-write-execute permissions. Such configuration allows attackers to inject malicious payloads at runtime. A malicious host can hijack any joining client system without requiring further victim interaction. Furthermore, when a host exits a match, server privileges transfer automatically to another player. This mechanic allows an attacker to gain host control and subsequently distribute the exploit across the entire active lobby. As a result, the vulnerability enables the compromise of multiple systems through a single exploitation event. Fortunately, researchers have not confirmed any active exploitation or public proof-of-concept for this flaw.
How the Attack Works
The issue stems from an input-validation failure within the Steam matchmaking lobby system. According to the CERT/CC report, “The function responsible for parsing this lobby data does not validate the kick_num value against the size of the fixed-length buffer allocated for kicked player identifiers.” An attacker supplies a value exceeding the fixed buffer capacity. Specifically, “supplying a kick_num value larger than the buffer capacity results in out-of-bounds writes into adjacent memory.” This adjacent memory houses internal Steamworks callback handler structures containing crucial function pointers. Finally, the overflow corrupts these structures, which redirects callback execution and grants the attacker full control over the affected client.
Affected Versions and Mitigation
This Metal Gear Online 3 RCE flaw specifically affects version 1.1.2.8. While exact daily player counts remain unconfirmed, the risk applies to anyone using the outdated software. To fix the issue, Konami released a patch in version 1.1.2.9 of the mgsvmgo.exe executable. Additionally, developers incremented the server and lobby version numbers to block older clients from accessing online services. Players must download the latest update through Steam to continue playing safely.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
