Executive brief
Metal Gear Online 3 is an online multiplayer game that uses Steam for matchmaking and lobby management. The game fails to validate player-removal data when clients join a lobby, allowing a malicious match host to remotely execute arbitrary code on players' computers simply by inviting them to join a crafted lobby.
Technical details
A heap-based buffer overflow exists in Metal Gear Online 3's lobby data parsing function, triggered by insufficient validation of the "kick_num" field that specifies the number of kicked players. The function allocates a fixed-size buffer for 16 player identifiers (matching the 16-player match limit) but does not enforce bounds on the kick_num value; supplying a larger value causes out-of-bounds writes. The overflow corrupts adjacent Steam callback handler structures containing function pointers and callback data, enabling control-flow hijacking. The binary's use of Denuvo protection with read-write-execute memory regions allows injection of attacker-supplied code. Exploitation is automatic when a client joins a malicious lobby—no user interaction is required. The vulnerability was fixed in version 1.1.2.9, released with server/lobby version bumps to prevent older clients from connecting.
Affected products
- Konami Metal Gear Online 3 1.1.2.8
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: Fix included in version 1.1.2.9