Metal Gear Online 3 lobby RCE flaw patched
A heap overflow in Metal Gear Online 3's Steam lobby data lets a malicious host achieve remote code execution on joining clients; fixed in v1.1.2.9.
CERT/CC disclosed CVE-2026-19874, a heap-based buffer overflow in Konami's Metal Gear Online 3 (Steam AppID 287700), version 1.1.2.8. The flaw exists in the client's parsing of Steam lobby metadata used for the player-removal feature: the game does not validate the kick_num value against the fixed-length buffer allocated for kicked-player Steam IDs, allowing an attacker-controlled lobby host to trigger out-of-bounds writes. Because these writes land on adjacent memory holding Steamworks callback handler structures (function pointers and callback arguments), an attacker can hijack control flow when a victim's client parses the malicious lobby data upon joining.
While initial exploitation only grants control-flow hijacking within existing in-process code, the game binary contains Denuvo-protected regions mapped with read-write-execute permissions, enabling arbitrary code injection and turning the bug into full remote code execution. No user interaction beyond joining a lobby is required, and because host privileges automatically transfer to another participant when a host leaves, an attacker can seize host control mid-match and push the malicious payload to all connected players, compromising multiple systems from a single exploitation event.
Konami has not published a dedicated advisory, but the vulnerability was silently fixed in version 1.1.2.9 (mgsvmgo.exe), which also incremented server and lobby version numbers to lock out clients running older, vulnerable builds. Defenders and players should ensure the game client is updated to 1.1.2.9 or later; no IOCs, malware, or active exploitation in the wild have been reported at this time.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Metal Gear Online 3 Client
Detects command interpreters or living-off-the-land binaries spawned as children of the MGO3 game client process, consistent with post-exploitation code execution following a client-side memory-corruption exploit (e.g. CVE-2026-19874). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Metal Gear Online 3 Client
description: 'Detects the game client process (mgsvmgo.exe) spawning a command interpreter,
scripting engine, or common living-off-the-land binary.
Legitimate game clients do not spawn shells or script hosts during normal play.
This pattern is consistent with successful exploitation of a
client-side memory-corruption vulnerability (e.g. CVE-2026-19874, a heap overflow
in Steam lobby metadata parsing) that hijacks control flow
and executes arbitrary code from within the game process after a victim joins a
malicious lobby.
'
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \mgsvmgo.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \rundll32.exe
- \regsvr32.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Third-party overlay or mod-manager tools that legitimately launch helper processes
from the game directory
- Anti-cheat or DRM (e.g. Denuvo) maintenance utilities spawned by the game binary
during startup
level: high
id: 60a3467f-e8ce-5b43-ba1d-38a0bfb42156
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/728712
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free