VU#728712: Konami's Metal Gear Online 3 contains a heap-based buffer overflow
CERT/CC details CVE-2026-19874, a heap overflow in Metal Gear Online 3 letting match hosts execute code on lobby members' machines.
VU#728712 describes a heap-based buffer overflow in Konami's Metal Gear Online 3, tracked as CVE-2026-19874, affecting version 1.1.2.8 (Steam AppID 287700). The input-validation flaw lies in processing Steam lobby metadata tied to the player-removal feature, letting a match host trigger remote code execution on lobby members' machines via specially crafted data. The game is an 8v8 competitive shooter using Steam Matchmaking for lobbies.
- Heap-based buffer overflow in lobby metadata parsing
- Match hosts can achieve RCE on lobby members' machines
- Affects Metal Gear Online 3 version 1.1.2.8 on Steam
- Disclosed via CERT/CC as VU#728712
- CVEs
- CVE-2026-19874
- Products
- Metal Gear Online 3Steam
- Organizations
- CERT/CC
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19874 | Heap-Based Buffer Overflow in Konami Metal Gear Online 3 Enables Code Execution | 9.1 | <1% |
From the original article
Overview Konami's Metal Gear Online 3 video game contains a heap-based buffer overflow that can be triggered by an input‑validation vulnerability that allows match hosts to remotely execute arbitrary code on lobby members' machines through specially crafted data. Description Metal Gear Online 3 is an online 8 vs. 8 competitive shooter game that uses Steam Matchmaking to handle its multiplayer lobbies and matches.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.