# Metal Gear Online 3 lobby RCE flaw patched

Published: 2026-08-24 · Severity: routine · Sectors: media
Canonical: https://vorant.io/reports/dd5bf5be-2534-51e5-aba2-0deff4e8f334/metal-gear-online-3-lobby-rce-flaw-patched

> A heap overflow in Metal Gear Online 3's Steam lobby data lets a malicious host achieve remote code execution on joining clients; fixed in v1.1.2.9.

CERT/CC disclosed CVE-2026-19874, a heap-based buffer overflow in Konami's Metal Gear Online 3 (Steam AppID 287700), version 1.1.2.8. The flaw exists in the client's parsing of Steam lobby metadata used for the player-removal feature: the game does not validate the kick_num value against the fixed-length buffer allocated for kicked-player Steam IDs, allowing an attacker-controlled lobby host to trigger out-of-bounds writes. Because these writes land on adjacent memory holding Steamworks callback handler structures (function pointers and callback arguments), an attacker can hijack control flow when a victim's client parses the malicious lobby data upon joining.

While initial exploitation only grants control-flow hijacking within existing in-process code, the game binary contains Denuvo-protected regions mapped with read-write-execute permissions, enabling arbitrary code injection and turning the bug into full remote code execution. No user interaction beyond joining a lobby is required, and because host privileges automatically transfer to another participant when a host leaves, an attacker can seize host control mid-match and push the malicious payload to all connected players, compromising multiple systems from a single exploitation event.

Konami has not published a dedicated advisory, but the vulnerability was silently fixed in version 1.1.2.9 (mgsvmgo.exe), which also incremented server and lobby version numbers to lock out clients running older, vulnerable builds. Defenders and players should ensure the game client is updated to 1.1.2.9 or later; no IOCs, malware, or active exploitation in the wild have been reported at this time.

## Mentioned in this report

- Vulnerabilities: CVE-2026-19874

## Detection guidance (public sample)

### Suspicious Child Process Spawned by Metal Gear Online 3 Client

ATT&CK: T1203

Detects command interpreters or living-off-the-land binaries spawned as children of the MGO3 game client process, consistent with post-exploitation code execution following a client-side memory-corruption exploit (e.g. CVE-2026-19874). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by Metal Gear Online 3 Client
description: 'Detects the game client process (mgsvmgo.exe) spawning a command interpreter,
  scripting engine, or common living-off-the-land binary.

  Legitimate game clients do not spawn shells or script hosts during normal play.
  This pattern is consistent with successful exploitation of a

  client-side memory-corruption vulnerability (e.g. CVE-2026-19874, a heap overflow
  in Steam lobby metadata parsing) that hijacks control flow

  and executes arbitrary code from within the game process after a victim joins a
  malicious lobby.

  '
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \mgsvmgo.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Third-party overlay or mod-manager tools that legitimately launch helper processes
  from the game directory
- Anti-cheat or DRM (e.g. Denuvo) maintenance utilities spawned by the game binary
  during startup
level: high
id: 60a3467f-e8ce-5b43-ba1d-38a0bfb42156
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/728712

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/dd5bf5be-2534-51e5-aba2-0deff4e8f334/metal-gear-online-3-lobby-rce-flaw-patched.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup