CVE-2026-19874
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, caused by improper validation of lobby data fields related to kicked players. The function processes a list of kicked player identifiers using the "kick_num" key without validating its bounds, allowing an attacker to supply an oversized value and overwrite adjacent memory structures, including Steam callback handlers. Successful exploitation may enable control-flow hijacking and arbitrary code execution within the game process.
Risk Assessment
The risk includes potential remote code execution within the game process, which could lead to full system compromise or server takeover. An attacker could leverage this to deploy malware or steal sensitive data.
Recommendation
Apply vendor-provided patches immediately and restrict access to game lobbies for untrusted players. Monitor security advisories for Metal Gear Online 3 for further updates.
Related vulnerabilities
- CVE-2026-96207Critical
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-94510Critical
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-88131Critical
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
- CVE-2026-77900Critical
Missing authentication for a critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
- CVE-2026-69435Critical
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
- CVE-2026-84249Critical
IBM Guardium Data Protection 12.2 and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for a critical function.
- CVE-2026-80381Critical
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.
- CVE-2026-75875Critical
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal.
- CVE-2026-107726Critical
Hazelcast prior to 5.4.5, 5.5.10, and 5.6.1 contains improper validation of data supplied by a malicious client able to connect to a cluster, allowing arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
- CVE-2026-107722Critical
fast-jwt from 6.2.0 until 6.3.0 can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored, so comments, control characters, zero-width characters, or wrapper text can prevent PEM detection and reach the HMAC fallback. An attacker who knows the public key bytes can sign arbitrary HS256 claims with that public material when HS256 is inferred or allowed, resulting in authentication or authorization bypass. An asymmetric-only algorithm allowlist prevents the attack. This issue is fixed in version 6.3.0.
Original NVD description (English source)
A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kick_num" to determine the number of entries, and individual kicked player IDs supplied via keys in the format "kicked_id_%i". The function does not validate that "kick_num" falls within the expected bounds. The game design limits matches to a maximum of 16 players, and the corresponding buffer for storing kicked player IDs is sized accordingly. If "kick_num" exceeds this limit, the function continues writing the provided player IDs past the end of the intended buffer and into adjacent memory regions. These adjacent regions contain Steam callback handler structures responsible for processing lobby data updates, lobby messages, and other related events. By supplying an oversized "kick_num" value and appropriate "kicked_id_%i" fields, an attacker can overwrite fields within the callback handler structures, including function pointers and callback argument values. Successful exploitation may enable control-flow hijacking, potentially allowing arbitrary code execution within the game process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS