PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-19874 Konami CVE debrief

A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key 'kick_num' to determine the number of entries, and individual kicked player IDs supplied via keys in the format 'kicked_id_%i'. The function does not validate that 'kick_num' falls within the expected bounds. The game design limits matches to a maximum of 16 players, and the corresponding buffer for storing kicked player IDs is sized accordingly. If 'kick_num' exceeds this limit, the function continues writing the provided player IDs past the end of the intended buffer and into adjacent memory regions. These adjacent regions contain Steam callback handler structures responsible for processing lobby data updates, lobby messages, and other related events. By supplying an oversized 'kick_num' value and appropriate 'kicked_id_%i' fields, an attacker can overwrite fields within the callback handler structures, including function pointers and callback argument values. Successful exploitation may enable control-flow hijacking, potentially allowing arbitrary code execution within the game process.

Vendor
Konami
Product
Metal Gear Online 3
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-24
Original CVE updated
2026-09-08
Advisory published
2026-08-24
Advisory updated
2026-09-08

Who should care

Defenders responsible for Konami's Metal Gear Online 3 game servers and players should assess exposure and prioritize verification of the affected version and application of patches or updates.

Why it matters

Defenders should prioritize verifying the affected version of Metal Gear Online 3 and applying patches or updates to prevent potential exploitation, as the vulnerability can lead to control-flow hijacking and arbitrary code execution within the game process.

  • Potential control-flow hijacking and arbitrary code execution within the game process
  • Possible disruption of game services and player experience
  • Potential exploitation by attackers to gain unauthorized access or control

Technical summary

The heap-based buffer overflow vulnerability in Metal Gear Online 3 occurs due to improper validation of lobby data fields related to kicked players. An attacker can supply an oversized 'kick_num' value and appropriate 'kicked_id_%i' fields to overwrite fields within the Steam callback handler structures, potentially enabling control-flow hijacking and arbitrary code execution within the game process.

Defensive priority

Defenders should prioritize verifying the affected version of Metal Gear Online 3 and applying any available patches or updates to prevent potential exploitation.

Recommended defensive actions

  • Verify the affected version of Metal Gear Online 3
  • Apply any available patches or updates
  • Monitor for suspicious activity related to lobby data updates and messages
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the heap-based buffer overflow vulnerability in Metal Gear Online 3. The CWE definition for CWE-122 is also referenced. Defenders should verify the affected version and apply patches or updates. Evidence is limited to public sources; further verification is recommended. The vulnerability allows potential control-flow hijacking and arbitrary code execution within the game process.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-19874 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-19874

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-19874 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-19874

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.