Loading story…
A critical heap-based buffer overflow in Konami's Metal Gear Online 3 let malicious Steam lobby hosts execute arbitrary code on a victim's computer when the victim joined the lobby. Tracked as CVE-2026-19874 and documented in CERT/CC advisory VU#728712, the issue affected mgsvmgo.exe version 1.1.2.8: an oversized kick_num value in lobby metadata could write beyond the buffer used for kicked-player Steam IDs, corrupting memory and potentially Steamworks callback structures.
Konami fixed the vulnerability in version 1.1.2.9. The company also raised required server and lobby version numbers, preventing older vulnerable clients from connecting to online services and reducing exposure to attacker-controlled lobbies.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CERT/CC published vulnerability note VU#728712 for CVE-2026-19874, a heap-based buffer overflow in Metal Gear Online 3's Steam lobby player-removal metadata handling. The issue could allow a malicious lobby host to execute code when a victim joined the lobby.
Konami released Metal Gear Online 3 version 1.1.2.9, fixing CVE-2026-19874 in mgsvmgo.exe. The update raised server and lobby version numbers to prevent older vulnerable clients from accessing online services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A vulnerability in **MECCHA CHAMELEON** let a malicious Steam Workshop custom-map lobby host execute attacker-controlled code on a joining player's Windows system. The game's Blueprint logic exposed an Unreal Engine recording-output function that attackers could use to write arbitrary files through controlled paths; a null-character path-handling discrepancy bypassed Unreal's automatic `.wav` filename suffix. Researchers demonstrated a two-click attack chain by embedding an HTML Application payload in uncompressed PCM WAV data, writing it to the Windows Startup folder, and relying on `mshta.exe` to run the payload after the victim restarted the system. Version **4.0.0** remediated the issue by preventing `StopRecordingOutput` from creating files; researchers reported finding no Workshop maps exploiting this specific flaw.
Sep 3, 2026
Two high-severity vulnerabilities, `CVE-2018-25265` and `CVE-2018-25268`, were documented for **LanSpy 2.0.1.159**, affecting the application's scan functionality and exposing users to local buffer overflow attacks. The flaws were classified as `CWE-787` and can let an attacker trigger memory corruption by supplying oversized input in the scan section or scan field, causing application crashes and creating a path to arbitrary code execution. The published details indicate that `CVE-2018-25265` can be exploited through structured exception handling (SEH), including egghunter-based shellcode discovery and controlled jumps, while `CVE-2018-25268` allows instruction pointer overwrite with a payload consisting of 688 bytes of padding followed by 4 bytes of attacker-controlled data. Both entries were assigned high-impact CVSS v3.1 and CVSS v4.0 severity metrics, and the records reference material from **LizardSystems**, **Exploit-DB**, and **VulnCheck**.
Jun 29, 2026
Two high-severity vulnerabilities have been disclosed in Open Vehicle Monitoring System 3 (**OVMS3**) version `3.3.005`, both stemming from improper input validation that can lead to buffer overflows. `CVE-2026-42469` affects `canformat_canswitch.cpp`, where the software fails to properly validate a CANswitch DLC value; a remote attacker can send crafted CANswitch frames to trigger a denial of service and potentially achieve arbitrary code execution. The flaw is tracked as **CWE-121** and carries a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H`, indicating network-reachable exploitation with no privileges or user interaction required and a high impact on availability. A second flaw, `CVE-2026-42468`, affects `canformat_pcap.cpp`, where OVMS3 does not correctly validate the `phdr.len` field while parsing PCAP input. An attacker can use crafted PCAP data to cause a denial of service and potentially execute arbitrary code; the updated CVSS v3.1 scoring indicates user interaction is required and that confidentiality, integrity, and availability may all be affected. The CVE records were updated to refine severity details, add **CWE-121** classification, and, for `CVE-2026-42469`, include a public GitHub Gist reference.
Jun 29, 2026