VU#728712: Konami's Metal Gear Online 3 contains a heap-based buffer overflow
Brief
Overview
Konami's Metal Gear Online 3 video game contains a heap-based buffer overflow that can be triggered by an input‑validation vulnerability that allows match hosts to remotely execute arbitrary code on lobby members' machines through specially crafted data.
Description
Metal Gear Online 3 is an online 8 vs. 8 competitive shooter game that uses Steam Matchmaking to handle its multiplayer lobbies and matches. As detailed in CVE‑2026‑19874 , version 1.
- 2. 8 of Metal Gear Online 3 (Steam AppID 287700) contains an input‑validation vulnerability in the processing of Steam lobby metadata related to the player‑removal feature.
The game tracks a lobby field ( kick_num ) indicating the number of players designated for removal, along with corresponding Steam ID entries of each kicked player ( kicked_id_%i ).