CVE-2026-19874

CVE-2026-19874 is a critical heap-based buffer overflow (CWE-122) in the lobby-data handling of Konami's Metal Gear Online 3: the code trusts the "kick_num" field for the count of kicked-player identifiers (supplied as "kicked_id_%i" keys) without validating it against the 16-entry buffer sized for the game's maximum match size. An attacker who can supply crafted lobby data, such as a lobby host or participant, can set "kick_num" above 16, causing the parser to write past the end of the kicked-ID buffer and into adjacent memory containing Steam callback handler structures, overwriting function pointers and callback arguments. This can lead to control-flow hijacking and potentially arbitrary code execution within the game process; the CVSS 9.1 score reflects network reachability with no privileges or user interaction required. Any player running the affected title who joins or hosts lobbies with untrusted peers is exposed (the described code path touches Steam callback structures, indicating the Steam-integrated client); no fixed version information is included in the available data. There is currently no public proof-of-concept, no known in-the-wild exploitation, and the issue is not in CISA's KEV; EPSS estimates a 0.7% probability of exploitation within 30 days (52nd percentile).

What to do: No patch details are available in the data; monitor Konami support channels and your game launcher (Steam/PlayStation) for an MGO3 client update and install it as soon as one ships. Until then, prefer private matches or lobbies hosted by trusted players, since exploitation requires an untrusted peer or host to supply an oversized "kick_num" with matching "kicked_id_%i" lobby fields. Treat unexplained client crashes or hangs during lobby joins as potentially related to this flaw.