External risk intelligence

Metal Gear Online 3 Lobby Data Heap Overflow Leads to Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-19874

This vulnerability exists within the lobby data processing logic of a specific video game. It is not a public-facing network service, web application, or gateway; it is client-side game software logic that requires a user to be actively playing the game, making public internet exposure in a general deployment sense very unlikely.

Buffer Overflow

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE involves a critical vulnerability in Konami's Metal Gear Online 3, specifically a buffer overflow when processing kicked player data. An attacker could exploit this to potentially execute arbitrary code within the game process. The main concern is confirming relevance and exposure to our environment.

Game vulnerability allows code execution.
High impact if game is used internally.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted lobby data to a vulnerable game client. This data, when processed, can cause a buffer overflow in the game's lobby component. The overflow can overwrite critical data structures, potentially allowing the attacker to gain control of the game process.

Requires network access to the game.
Triggered by sending malformed lobby data.
Risk of code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the integrity and availability of the game process when processing lobby data. An attacker could potentially overwrite critical data structures, leading to control-flow hijacking and arbitrary code execution within the game.

Game process integrity and availability.
Malicious lobby data can overwrite structures.
Arbitrary code execution within the game.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Konami's Metal Gear Online 3, specifically its lobby data handling for kicked players. Action will likely fall to the game's platform or infrastructure team, in coordination with the vendor and potentially network/security teams for exposure assessment. The first practical step is to identify all installations, determine their reachability and criticality, and locate the accountable owner before planning remediation.

Game platform or infrastructure team ownership.
Verify game installation and network exposure.
Coordinate vendor patch or apply mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Konami's Metal Gear Online 3?

Metal Gear Online 3 is the multiplayer component of the Metal Gear Solid V game. It allows players to participate in tactical team-based matches. The software manages networking and player sessions, including lobby systems that track match participants and state information, such as player expulsion data.

What is the vulnerability in CVE-2026-19874?

This vulnerability is a heap-based buffer overflow, classified as CWE-122. It occurs when the game processes lobby data regarding kicked players. The software fails to verify that the number of kicked players stays within the memory limit allocated for that task. If a provided value is too high, the game writes data into adjacent memory, potentially overwriting internal callback handlers.

How can an attacker trigger this buffer overflow?

An attacker triggers the bug by sending specially crafted lobby data containing an oversized 'kick_num' value. This forces the game to write player ID data beyond the designated buffer boundaries. Simply having the game installed or running without processing this specific, malformed lobby update does not trigger the vulnerability.

Is my network environment at risk from this CVE?

According to Halo Surface Signal, this risk is very unlikely for typical enterprise environments. The vulnerability exists within client-side game software logic rather than a public-facing network service or web gateway. It requires a user to be actively playing the game, meaning it does not generally present the same exposure as traditional network infrastructure.

How should I respond to CVE-2026-19874?

The first step is to identify all systems where Metal Gear Online 3 is installed. Once located, verify the network reachability of these systems and determine who is responsible for their maintenance. Coordinate with the relevant infrastructure team to monitor for vendor-provided patches and avoid using the application on untrusted networks until a fix is applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.