CVE-2026-19874

Name of the Vulnerable Software and Affected Versions Metal Gear Online 3 version 1.2.8

Description A heap-based buffer overflow occurs due to improper validation of lobby data fields related to kicked players. The affected function uses the lobby data key kick num to determine the number of entries and processes individual kicked player IDs supplied via keys in the format kicked id %i. Because the function fails to validate that kick num falls within the expected bounds of the buffer—which is sized for a maximum of 16 players—an attacker can provide an oversized kick num value to write data past the end of the buffer into adjacent memory regions. These regions contain Steam callback handler structures used for processing lobby data updates and messages. By overwriting function pointers and callback argument values within these structures, a malicious match host can achieve control-flow hijacking and arbitrary code execution on the machines of lobby members.

Recommendations Update Metal Gear Online 3 to a version newer than 1.2.8. Disable matchmaking for Metal Gear Online 3. Block the Steam AppID (287700) at the network perimeter.