Metal Gear Online 3 Vulnerability Allowed Remote Code Execution via Steam Matchmaking

Anatomy of the Heap-Based Buffer Overflow in Steam Matchmaking

Metal Gear Online 3 serves as the multiplayer component for Metal Gear Solid V: The Phantom Pain, utilizing Steam Matchmaking to coordinate 8-versus-8 competitive matches. The vulnerability originates within the player-removal mechanism of the game client. Lobbies manage excluded users utilizing a `kick_num` variable alongside string keys structured as `kicked_id_%i` to track banned Steam IDs.

When an incoming client parses session parameters, the application fails to verify whether the incoming `kick_num` integer fits inside the fixed-size allocation bounds of the target buffer. Because match parameters cap participant counts at sixteen players, exceeding this ceiling triggers out-of-bounds heap writes. Adjacent memory blocks house crucial Steamworks callback handler structures containing active function pointers and argument payloads.

// Conceptual representation of vulnerable lobby metadata parsing
void parse_lobby_kicked_players(const char* payload, size_t payload_len) {
    int kick_num = get_metadata_int(payload, "kick_num");
    // Vulnerability: No validation that kick_num <= MAX_PLAYERS (16)
    for (int i = 0; i < kick_num; i++) {
        char key[32];
        snprintf(key, sizeof(key), "kicked_id_%i", i);
        // Out-of-bounds write corrupts adjacent Steamworks callback pointers
        write_to_fixed_buffer(get_metadata_string(payload, key));
    }
}

By carefully constructing oversized payloads, an attacker overwrites these function pointers, successfully hijacking control flow. Exploitation happens instantly upon joining an attacker-controlled lobby with no user interaction required. Furthermore, sections of the `mgsvmgo.exe` binary protected by Denuvo are mapped with read-write-execute (RWX) permissions, providing immediate runway for injected shellcode once execution control transfers.

Infrastructure Remediation and Deployment Realities

Gaming setups running legacy game binaries face host-privilege escalation risks if sessions migrate. Metal Gear Online 3 automatically migrates hosting duties when an active session leader departs, meaning secondary participants can inherit malicious metadata handling responsibilities mid-match.

Konami patched the vector in update version 1.1.2.9, which surfaced on SteamDB as Build 24176213 on August 4, 2026. The patch modifies `mgsvmgo.exe`, `mgsvtpp.exe`, and supporting data archives (`mgo/chunk0.dat`), updating server and lobby version numbers to lock out unpatched clients. Users who have disabled automatic updates should apply the current version before joining public or untrusted multiplayer lobbies.