Join a lobby, get pwned: critical remote code execution bug found in Konami’s Metal Gear Online 3
A single unchecked data field can overwrite and corrupt sensitive memory regions and let attackers run their own code.
Image by Cybernews.
- A critical Metal Gear Online 3 flaw lets attackers compromise players’ computers when they join a malicious lobby.
- CERT/CC disclosed the bug, tracked as CVE-2026-19874, with a critical 9.1 severity score.
- Attackers can gain lobby host control and send malicious data to every connected player in one match.
- Konami fixed the issue in version 1.1.2.9, blocking older game versions from online services.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
A newly discovered critical vulnerability in Konami’s Metal Gear Online 3 shows how a malicious game lobby can become an entry point to players’ computers. Simply joining a game can get you completely compromised.
The game fails to properly validate data received from the Steam lobby, leading to a buffer overflow, which enables remote code execution (RCE).
The bug was disclosed by the CERT Coordination Center (CERT/CC) within Carnegie Mellon University.
Metal Gear Online 3 is the multiplayer mode of Konami’s Metal Gear Solid V title, released in 2015. It’s a competitive shooter game where up to 16 players battle across 2 teams. A dedicated player base still keeps the game alive.
The bug underscores the dangers game players face online – simply joining a malicious lobby can lead to full compromise without any further interaction.
And attackers can compromise any lobby.
“Because host privileges are automatically reassigned to another lobby participant when the current host exits, an attacker can obtain host control during an active match and subsequently deliver the malicious lobby data to all connected players. This enables compromise of multiple systems through a single exploitation event,” the advisory reads.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
The bug, tracked as CVE‑2026‑19874, has a critical severity score of 9.1 out of 10.
The fix was shipped in the executable version 1.1.2.9, and the patch iterated server and lobby versions to prevent players on older versions from accessing online services. Konami hasn’t released patch notes or an advisory.
How does the exploit work?
Malicious game hosts can trigger the memory corruption vulnerability by supplying specially crafted data in the “kick_num” field, which tracks how many players have been removed from the game, along with corresponding kicked players’ Steam ID entries.
When new players join a match, the game receives this information to check whether its own Steam ID is on the list – if so, the player is prevented from joining.
However, the “kick_num” can be crafted to supply more data than the buffer capacity, the memory area reserved on players’ computers. The game doesn’t validate that “kick_num” falls outside the expected bounds, and continues writing the provided data past the end of the intended buffer into adjacent memory regions.
The overflowing data overwrites internal Steamworks structures that determine which code should run when processing lobby updates and messages.
“By manipulating the overflow, an attacker can corrupt these handler structures and redirect callback execution, resulting in control‑flow hijacking on affected client systems. The vulnerability can be triggered automatically when a client joins a lobby controlled by an attacker,” the advisory reads.
What makes the bug even more severe is that attackers can go beyond the game’s existing code and inject a malicious payload into Denuvo-protected memory regions with read, write, and execute permissions.
Successful exploitation may enable control-flow hijacking, potentially allowing arbitrary code execution within the game process.
“An attacker hosting a lobby can achieve code execution on any client that joins, without requiring further interaction from the victim,” the Cert/CC warned.