CVE-2026-19874: Konami's Metal Gear Online 3 contains a heap-based buffer overflow
A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kicknum" to determine the number of entries, and individual kicked player IDs supplied via keys in the format "kickedid%i". The function does not validate that "kicknum" falls within the expected bounds. The game design limits matches to a maximum of 16 players, and the corresponding buffer for storing kicked player IDs is sized accordingly. If "kicknum" exceeds this limit, the function continues writing the provided player IDs past the end of the intended buffer and into adjacent memory regions. These adjacent regions contain Steam callback handler structures responsible for processing lobby data updates, lobby messages, and other related events. By supplying an oversized "kicknum" value and appropriate "kickedid%i" fields, an attacker can overwrite fields within the callback handler structures, including function pointers and callback argument values. Successful exploitation may enable control-flow hijacking, potentially allowing arbitrary code execution within the game process.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Game clients that process lobby data containing kicked-player fields are exposed. The vulnerable processing occurs when the client reads the lobby's "kick_num" value and associated "kicked_id_%i" entries.
What does an attacker need to provide to trigger the overflow?
The attacker needs to supply lobby data with a "kick_num" value greater than the expected maximum of 16, along with corresponding "kicked_id_%i" fields. The excessive count causes player IDs to be written beyond the buffer intended for 16 entries.
How can I identify suspicious or potentially malicious lobby data?
Check for a "kick_num" value exceeding 16, especially when the lobby also contains kicked-player identifier keys numbered beyond the expected range. Such data can overwrite adjacent Steam callback handler structures.
What is the potential security impact of exploitation?
The overflow can overwrite Steam callback handler structures used for lobby updates, lobby messages, and related events. This may allow an attacker to modify function pointers and callback arguments, potentially hijacking control flow.