Description

A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kick_num" to determine the number of entries, and individual kicked player IDs supplied via keys in the format "kicked_id_%i". The function does not validate that "kick_num" falls within the expected bounds. The game design limits matches to a maximum of 16 players, and the corresponding buffer for storing kicked player IDs is sized accordingly. If "kick_num" exceeds this limit, the function continues writing the provided player IDs past the end of the intended buffer and into adjacent memory regions. These adjacent regions contain Steam callback handler structures responsible for processing lobby data updates, lobby messages, and other related events. By supplying an oversized "kick_num" value and appropriate "kicked_id_%i" fields, an attacker can overwrite fields within the callback handler structures, including function pointers and callback argument values. Successful exploitation may enable control-flow hijacking, potentially allowing arbitrary code execution within the game process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-24T15:16:37.577Z",
  "pubdate": "2026-08-24T15:16:37.577Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, specifically within the lobby data processing functionality handling kicked player lists. The vulnerability arises due to insufficient bounds validation of the lobby data key 'kick_num', which dictates the quantity of entries processed by the affected function. Because the maximum match capacity is restricted to 16 players, the corresponding memory buffer allocated for storing kicked player identifiers is statically dimensioned to accommodate this limit. If an attacker supplies an oversized 'kick_num' value along with maliciously crafted 'kicked_id_%i' fields, the routine continuously writes player identifiers beyond the boundaries of the intended heap allocation, resulting in a heap-based buffer overflow that corrupts adjacent memory regions.\nThe primary impact of this vulnerability is control-flow hijacking and potential arbitrary code execution within the context of the game process. The adjacent memory regions targeted by the overflow contain Steam callback handler structures, which hold critical function pointers and associated callback argument values responsible for managing lobby data updates, lobby messages, and asynchronous events. Successful exploitation allows an attacker to overwrite these function pointers and arguments, redirecting execution flow to attacker-controlled instructions. Exploitation requires the ability to supply malicious lobby data fields containing oversized indices and payload identifiers to the affected client or server handling the lobby state.",
  "technicalDetails": "The vulnerability resides in the function responsible for parsing and processing lobby data related to kicked players in Konami's Metal Gear Online 3. The root cause is an absence of strict input validation and boundary checking on the 'kick_num' lobby data key, which defines the iterative loop boundary for processing subsequent player identifiers. The application allocates a fixed-size heap buffer sized appropriately for the game design limit of 16 players to store the parsed kicked player IDs supplied via the 'kicked_id_%i' format strings.\nDuring the parsing routine, the function retrieves the value associated with 'kick_num' and utilizes it as a counter without verifying whether it exceeds the maximum capacity of the pre-allocated buffer. When an attacker provides a 'kick_num' value greater than 16, the processing loop iterates beyond the intended termination point. As 'kicked_id_%i' fields are sequentially read and copied, the write operations overrun the allocated heap buffer boundary and spill over into adjacent heap memory chunks.\nThe adjacent memory regions immediately following the vulnerable buffer house critical Steam callback handler structures. These structures contain essential operational data, including function pointers utilized for dispatching lobby data updates, processing lobby messages, and handling related networking and system events. By carefully crafting the oversized 'kick_num' and supplying precise values through the 'kicked_id_%i' payload fields, an attacker can systematically overwrite specific function pointers and callback argument structures located within these adjacent memory regions.\nWhen the application subsequently attempts to invoke the corrupted Steam callback handlers, the execution flow is redirected to the instruction addresses supplied by the attacker. This control-flow hijacking mechanism enables the execution of arbitrary code within the privileges of the game process. The attack flow relies entirely on the reception and processing of malicious lobby data updates, allowing an attacker capable of manipulating lobby communications to compromise client or host stability and achieve arbitrary code execution without requiring prior authentication or elevated privileges."
}