- The Mess: Metal Gear Online 3 had a heap-based buffer overflow tracked as CVE-2026-19874. A malicious lobby host could send crafted lobby data and trigger arbitrary code execution on players’ PCs simply by getting them to join the match.
The bug sits in the game’s handling of the kick_num field, which controls information about players removed from a lobby. The value was not properly validated. Feed it something larger than the expected buffer can handle, and the game writes beyond its allocated memory.
That is where things get ugly.
The overwritten memory included Steamworks callback structures used to determine what code executes next. An attacker could corrupt those structures and hijack the program’s control flow. No suspicious download. No phishing link. No “click Enable Content.”
Join the attacker’s lobby. That’s enough.
The vulnerability affected version 1.1.2.8 of the PC game. CERT/CC says Konami fixed it in 1.1.2.9, changing server and lobby version numbers so vulnerable clients can no longer connect to the online service.
There is another nasty detail. CERT/CC notes that Denuvo-related memory regions with read, write and execute permissions made exploitation easier. In addition, if a lobby host left, host privileges could be transferred to another player, potentially giving an attacker the ability to distribute malicious lobby data to everyone still connected.
- The Damage: A successful exploit can turn a multiplayer match into a remote-code-execution delivery mechanism, potentially giving the attacker control over the victim’s PC and allowing malware, credential stealers or other payloads to be deployed.
The interesting part is the attack model.
Normally, gamers worry about malicious files, fake mods, cracked executables and shady Discord links. This bug cuts around all of that. The malicious content travels through the game’s multiplayer infrastructure.
And one compromised host could potentially target multiple players in the same lobby.
That makes this more than a funny “old game has a bug” story. It is a reminder that multiplayer protocols are attack surfaces too. If the client blindly trusts data coming from another player, the game itself becomes the delivery mechanism.
One important correction: CVE-2026-19874 does not currently have an official NVD CVSS score, despite some security reports describing it as 9.1. The technical impact — remote code execution through a malicious lobby — is the more important fact here.
- The Fix: Update Metal Gear Online 3 to version 1.1.2.9 before playing online and do not use older clients; the patched version blocks vulnerable versions from connecting to the online service.
Bugstoday Opinion
This one is almost funny.
You join a game expecting someone to shoot you.
Instead, they can potentially make your PC execute their code.
The vulnerability also shows why “it’s just a game” is a terrible security argument. Multiplayer games process enormous amounts of untrusted data from strangers. One unchecked field was enough to turn a lobby into an RCE primitive.
And the victim doesn’t have to be stupid.
They just have to click Join.
Bugstoday verdict: update the game. If someone sends you an invite to a suspicious lobby, remember — the boss fight might not be inside the game.
