Metal Gear Online 3 lobby RCE flaw patched
A heap overflow in Metal Gear Online 3's Steam lobby data lets a malicious host achieve remote code execution on joining clients; fixed in v1.1.2.9.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC disclosed CVE-2026-19874, a heap-based buffer overflow in Konami's Metal Gear Online 3 (Steam AppID 287700), version 1.1.2.8. The flaw exists in the client's parsing of Steam lobby metadata used for the player-removal feature: the game does not validate the kick_num value against the fixed-length buffer allocated for kicked-player Steam IDs, allowing an attacker-controlled lobby host to trigger out-of-bounds writes. Because these writes land on adjacent memory holding Steamworks callback handler structures (function pointers and callback arguments), an attacker can hijack control flow when a victim's client parses the malicious lobby data upon joining.
While initial exploitation only grants control-flow hijacking within existing in-process code, the game binary contains Denuvo-protected regions mapped with read-write-execute permissions, enabling arbitrary code injection and turning the bug into full remote code execution. No user interaction beyond joining a lobby is required, and because host privileges automatically transfer to another participant when a host leaves, an attacker can seize host control mid-match and push the malicious payload to all connected players, compromising multiple systems from a single exploitation event.
Konami has not published a dedicated advisory, but the vulnerability was silently fixed in version 1.1.2.9 (mgsvmgo.exe), which also incremented server and lobby version numbers to lock out clients running older, vulnerable builds. Defenders and players should ensure the game client is updated to 1.1.2.9 or later; no IOCs, malware, or active exploitation in the wild have been reported at this time.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Metal Gear Online 3 Client
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects command interpreters or living-off-the-land binaries spawned as children of the MGO3 game client process, consistent with post-exploitation code execution following a client-side memory-corruption exploit (e.g. CVE-2026-19874). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Metal Gear Online 3 Client
description: 'Detects the game client process (mgsvmgo.exe) spawning a command interpreter,
scripting engine, or common living-off-the-land binary.
Legitimate game clients do not spawn shells or script hosts during normal play.
This pattern is consistent with successful exploitation of a
client-side memory-corruption vulnerability (e.g. CVE-2026-19874, a heap overflow
in Steam lobby metadata parsing) that hijacks control flow
and executes arbitrary code from within the game process after a victim joins a
malicious lobby.
'
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \mgsvmgo.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \rundll32.exe
- \regsvr32.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Third-party overlay or mod-manager tools that legitimately launch helper processes
from the game directory
- Anti-cheat or DRM (e.g. Denuvo) maintenance utilities spawned by the game binary
during startup
level: high
id: 60a3467f-e8ce-5b43-ba1d-38a0bfb42156
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/728712
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs