PatchSiren cyber security CVE debrief
CVE-2026-19874 Konami CVE debrief
A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key 'kick_num' to determine the number of entries, and individual kicked player IDs supplied via keys in the format 'kicked_id_%i'. The function does not validate that 'kick_num' falls within the expected bounds. The game design limits matches to a maximum of 16 players, and the corresponding buffer for storing kicked player IDs is sized accordingly. If 'kick_num' exceeds this limit, the function continues writing the provided player IDs past the end of the intended buffer and into adjacent memory regions. These adjacent regions contain Steam callback handler structures responsible for processing lobby data updates, lobby messages, and other related events. By supplying an oversized 'kick_num' value and appropriate 'kicked_id_%i' fields, an attacker can overwrite fields within the callback handler structures, including function pointers and callback argument values. Successful exploitation may enable control-flow hijacking, potentially allowing arbitrary code execution within the game process.
- Vendor
- Konami
- Product
- Metal Gear Online 3
- CVSS
- CRITICAL 9.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-24
- Original CVE updated
- 2026-09-08
- Advisory published
- 2026-08-24
- Advisory updated
- 2026-09-08
Who should care
Defenders responsible for Konami's Metal Gear Online 3 game servers and players should assess exposure and prioritize verification of the affected version and application of patches or updates.
Why it matters
Defenders should prioritize verifying the affected version of Metal Gear Online 3 and applying patches or updates to prevent potential exploitation, as the vulnerability can lead to control-flow hijacking and arbitrary code execution within the game process.
- Potential control-flow hijacking and arbitrary code execution within the game process
- Possible disruption of game services and player experience
- Potential exploitation by attackers to gain unauthorized access or control
Technical summary
The heap-based buffer overflow vulnerability in Metal Gear Online 3 occurs due to improper validation of lobby data fields related to kicked players. An attacker can supply an oversized 'kick_num' value and appropriate 'kicked_id_%i' fields to overwrite fields within the Steam callback handler structures, potentially enabling control-flow hijacking and arbitrary code execution within the game process.
Defensive priority
Defenders should prioritize verifying the affected version of Metal Gear Online 3 and applying any available patches or updates to prevent potential exploitation.
Recommended defensive actions
- Verify the affected version of Metal Gear Online 3
- Apply any available patches or updates
- Monitor for suspicious activity related to lobby data updates and messages
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Evidence notes
The CVE record and NVD vulnerability detail provide information on the heap-based buffer overflow vulnerability in Metal Gear Online 3. The CWE definition for CWE-122 is also referenced. Defenders should verify the affected version and apply patches or updates. Evidence is limited to public sources; further verification is recommended. The vulnerability allows potential control-flow hijacking and arbitrary code execution within the game process.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-19874 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-19874
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-19874 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-19874
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://cwe.mitre.org/data/definitions/122.html
-
Source reference
Unverified legacy reference
URL: https://kb.cert.org/vuls/id/728712
-
Source reference
Unverified legacy reference
URL: https://www.kb.cert.org/vuls/id/728712
af854a3a-2127-422b-91ae-364da2661108
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.