Metal Gear Online 3, a competitive shooter, has a critical security flaw. This vulnerability stems from an input validation issue within the game's Steam lobby metadata processing. Specifically, the game fails to check the size of a buffer used to store Steam IDs of removed players. When a lobby host crafts specific data, they can trick clients into writing beyond this buffer's boundaries. This out-of-bounds write corrupts adjacent memory structures responsible for handling game events.By carefully manipulating this overflow, attackers can hijack the control flow of the game on client machines. This allows them to execute arbitrary code. The exploit is triggered automatically when a player joins an attacker-controlled lobby. The vulnerability is particularly severe because the game binary contains regions with read-write-execute permissions, enabling code injection. An attacker can gain host privileges and then distribute malicious data to all connected players. Konami has addressed this vulnerability in version 1.1.2.9 of Metal Gear Online 3. This patch also updated server and lobby versions to prevent older clients from connecting.