A heap‑based buffer overflow exists in Konami’s Metal Gear Online 3 when processing lobby data for kicked players. The function reads a "kick_num" field to determine how many player IDs to copy, but it does not validate that the value is within the expected limit of 16. An attacker can supply a larger number and a corresponding set of "kicked_id_%i" fields. The routine then writes past the end of its allocated buffer, overwriting adjacent memory that holds Steam callback handler structures, including function pointers and callback arguments. This control‑flow hijacking can lead to arbitrary code execution within the game process.

Konami Metal Gear Online 3; all installations using the lobby kick‑handling logic are affected because the vulnerability resides in a core component of the game’s multiplayer routine.

The CVSS score is 9.1, EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the description indicates that the overflow can be triggered by data transmitted over Steam’s network layer, which is a remote attack vector. Because an attacker can overwrite function pointers and redirect execution flow, the potential impact is high. The lack of exploitation statistics makes precise risk assessment difficult, but the opportunity to gain code execution within the game process poses a severe threat to players who participate in public or friend‑listed lobbies.