Metal Gear Online 3 (Steam AppID 287700) version 1.1.2.8 has an input-validation vulnerability in the Steam lobby metadata processing for the player-removal feature. The kick_num field, indicating the number of players to be removed, is not validated against the fixed-length buffer size allocated for kicked player identifiers. An attacker controlling a lobby can supply a kick_num value larger than the buffer capacity, causing out-of-bounds writes that overwrite adjacent Steamworks callback handler structures containing function pointers. This enables control-flow hijacking and remote code execution on clients joining the lobby. The Metal Gear Online 3 binary includes Denuvo-protected RWX memory regions, allowing injected code execution at runtime. Host privileges can be reassigned during matches, enabling an attacker to compromise multiple clients via a single lobby. The vulnerability is addressed in version 1.1.2.9 of mgsvmgo.exe, which also increments server and lobby version numbers to block older vulnerable clients.

Successful exploitation allows an attacker hosting a lobby to remotely execute arbitrary code on any client that joins, without requiring victim interaction beyond joining the lobby. The presence of RWX Denuvo-protected regions in the binary increases the severity by permitting runtime code injection. Additionally, host privileges can be reassigned during matches, enabling the attacker to spread the exploit to multiple players in an active session. This results in a high risk of widespread client compromise in multiplayer environments.

A fix for this vulnerability is available in Metal Gear Online 3 version 1.1.2.9. This patch updates the executable mgsvmgo.exe and increments server and lobby version numbers to prevent vulnerable clients from connecting. Users and administrators should upgrade to version 1.1.2.9 or later to remediate this issue. No vendor advisory was released at the time of this report, but the patch is confirmed via SteamDB patch notes.