CVE-2026-19874

A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kick_num" to determine the number of entries, and individual kicked player IDs supplied via keys in the format "kicked_id_%i". The function does not validate that "kick_num" falls within the expected bounds. The game design limits matches to a maximum of 16 players, and the corresponding buffer for storing kicked player IDs is sized accordingly. If "kick_num" exceeds this limit, the function continues writing the provided player IDs past the end of the intended buffer and into adjacent memory regions. These adjacent regions contain Steam callback handler structures responsible for processing lobby data updates, lobby messages, and other related events. By supplying an oversized "kick_num" value and appropriate "kicked_id_%i" fields, an attacker can overwrite fields within the callback handler structures, including function pointers and callback argument values. Successful exploitation may enable control-flow hijacking, potentially allowing arbitrary code execution within the game process.

• CWE-122

• https://cwe.mitre.org/data/definitions/122.html
• https://kb.cert.org/vuls/id/728712
• https://www.kb.cert.org/vuls/id/728712

Published

Aug 24, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19869@neo4j/graphql from 5.2.0 until the patched versions fails t…7.6
• CVE-2026-1987The Scheduler Widget plugin for WordPress is vulnerable to I…5.4
• CVE-2026-19870Authorization Bypass Through User-Controlled Key in the payr…8.6
• CVE-2026-19871Use of Hard-coded Credentials in the human resources compone…9.3
• CVE-2026-19872HTML::FormHandler versions before 0.410000 for Perl allow cr…6.1
• CVE-2026-19873HTML::FormFu versions through 2.08 for Perl allow resource e…7.5
• CVE-2026-19875IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote a…7.5
• CVE-2026-19879A flaw was found in Undertow, an HTTP server, within its HTT…5.3
• CVE-2026-1988The Flexi Product Slider and Grid for WooCommerce plugin for…7.5
• CVE-2026-19880Path-traversal vulnerability in QOS.CH Sarl Logback-classic …6.3
• CVE-2026-19883The WPeMatico RSS Feed Fetcher plugin for WordPress is vulne…8.8
• CVE-2026-19884In Eclipse Theia versions up to and including 1.69.0, openin…8.4