A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3

CVE-2026-19874 is a heap-based buffer overflow in Konami's Metal Gear Online 3 (the multiplayer component bundled with Metal Gear Solid V: The Phantom Pain, Steam AppID 287700). Version 1.1.2.8 of mgsvmgo.exe fails to validate the kick_num lobby metadata field against the fixed 16-entry buffer for kicked-player Steam IDs. A malicious lobby host supplies an oversized value, triggering out-of-bounds writes that corrupt adjacent Steamworks callback structures containing function pointers. Because Denuvo-protected memory regions carry read-write-execute permissions, the attacker achieves arbitrary code execution on every client that joins the poisoned lobby — no click required. The fix shipped in version 1.1.2.9 on 2026-08-04, which bumped the lobby protocol version and prevents older clients from connecting.

The vendor CVSS of 9.1 CRITICAL is technically defensible *for the attack surface it describes*: network-reachable, zero-auth, zero-interaction RCE. But CVSS has no knob for 'is this software relevant to your enterprise?' Metal Gear Online 3 is a consumer video game. It should never appear on a managed corporate endpoint, and if it does, the correct response is an asset-hygiene ticket, not a P1 patch cycle. The vendor severity wildly overstates the risk to any organization running a software-allowlist or endpoint-management policy.

Why this verdict

• Enterprise relevance is nil. Metal Gear Online 3 is a 2015-era consumer game multiplayer component. It does not appear in any enterprise software catalog, CMDB, or approved application list. If it exists on a corporate endpoint, it is shadow IT.
• Role multiplier: not applicable. The affected component occupies *none* of the high-value deployment roles (not an IdP, hypervisor, CI/CD tool, backup system, security agent, network edge, database, or anything in the enterprise stack). It is a consumer entertainment application. Blast radius is limited to the individual gaming PC — there is no lateral movement, no domain impact, no fleet consequence.
• Auto-update already resolved it. The patch shipped on 2026-08-04, three weeks before public disclosure. Steam's default auto-update means the vast majority of the ~1,500 active players are already patched. Additionally, the lobby protocol version bump prevents unpatched clients from connecting at all, effectively killing the attack surface server-side.
• Execution context is limited. Even if exploited, code runs as the logged-in standard user, not SYSTEM. On a hypothetical managed endpoint with EDR, post-exploitation would be detected and contained.

Why not higher?

This vulnerability has zero enterprise attack surface. The affected software is a consumer video game that should never be present on managed corporate endpoints. There is no high-value deployment role, no supply-chain risk, no identity or infrastructure impact. Raising this above IGNORE would waste patch-management cycles on software that belongs in an asset-hygiene cleanup, not a vulnerability remediation workflow.

Why not lower?

IGNORE is already the lowest severity bucket. The vulnerability is technically real and the RCE primitive is sound, which prevents dismissing it as a non-issue entirely — it just has no enterprise relevance.

1. Enforce application allowlisting — If your endpoint management permits only approved executables, mgsvmgo.exe and Steam game binaries should already be blocked. Confirm your allowlist policy covers all managed endpoints. This is a standing control, not a CVE-specific response.
2. Audit for unauthorized game installations — Run a software inventory query across your fleet for Steam AppID 287700 or mgsvmgo.exe. Flag and remove any instances as a policy violation. This is an asset-hygiene action, not a patching action.

Run on any Windows endpoint where you suspect MGSV:TPP may be installed. Execute as a standard user in PowerShell: .\Check-CVE-2026-19874.ps1. No elevated privileges required.

# Check-CVE-2026-19874.ps1
# Checks for vulnerable Metal Gear Online 3 (mgsvmgo.exe) version
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN (not installed)

$steamPaths = @(
    "${env:ProgramFiles(x86)}\Steam\steamapps\common\MGS_TPP",
    "${env:ProgramFiles}\Steam\steamapps\common\MGS_TPP",
    "D:\SteamLibrary\steamapps\common\MGS_TPP",
    "E:\SteamLibrary\steamapps\common\MGS_TPP"
)

$found = $false
foreach ($base in $steamPaths) {
    $exe = Join-Path $base "mgsvmgo.exe"
    if (Test-Path $exe) {
        $found = $true
        $ver = (Get-Item $exe).VersionInfo.FileVersion
        if ($null -eq $ver -or $ver -eq '') {
            Write-Output "UNKNOWN - mgsvmgo.exe found at $exe but version could not be read"
            exit 2
        }
        # Vulnerable version is 1.1.2.8; fixed is 1.1.2.9+
        try {
            $v = [version]$ver
            $vuln = [version]'1.1.2.8'
            if ($v -le $vuln) {
                Write-Output "VULNERABLE - mgsvmgo.exe version $ver found at $exe (fixed in 1.1.2.9)"
                exit 1
            } else {
                Write-Output "PATCHED - mgsvmgo.exe version $ver at $exe"
                exit 0
            }
        } catch {
            Write-Output "UNKNOWN - could not parse version string: $ver"
            exit 2
        }
    }
}

if (-not $found) {
    Write-Output "UNKNOWN - Metal Gear Online 3 (mgsvmgo.exe) not found on this system"
    exit 2
}

Sources

1. NVD - CVE-2026-19874
2. CERT/CC VU#728712
3. SC Media - Metal Gear Online 3 RCE
4. Vista Net - VU#728712 Advisory
5. CWE-122: Heap-based Buffer Overflow
6. MITRE CVE Record