Valve: Steam Windows 0-Day Vulnerability Allows Users to Silently Escalate to Full SYSTEM Privileges

Windows Zero-Day in Steam Client Service Grants SYSTEM Privileges

A newly disclosed zero-day vulnerability in the Steam Client Service for Windows allows local attackers to escalate privileges to NT AUTHORITY\SYSTEM the highest level of access on a system without requiring administrator credentials, User Account Control (UAC) prompts, or Steam authentication.

Security researcher KillaBoi released the BrokenPipe proof-of-concept (PoC) exploit on September 14, demonstrating how an unprivileged local user can abuse steamservice.exe, Steam’s privileged Windows service. The flaw stems from a signature-coverage gap in Steam’s installation workflow: while the service accepts a Valve-signed install-script (VDF), it fails to validate the caller-controlled installation root path, enabling attackers to redirect execution to malicious code.

The exploit works by:

1. Establishing an inter-process communication (IPC) connection to the Steam Client Service.
2. Invoking IClientInstallUtils::AddInstallScriptToWhiteList with a legitimate VDF and an attacker-specified path, tricking the service into trusting a relocated launcher.
3. Triggering IClientInstallUtils::RunInstallScript, which executes the launcher with SYSTEM-level privileges.

The PoC, written in PowerShell with embedded C#, demonstrates the attack by copying cmd.exe to a user-controlled location and executing it as SYSTEM, confirmed by whoami returning NT AUTHORITY\SYSTEM (SID S-1-5-18). The exploit was successfully tested against Steam version 10.96.30.42 on Windows 10 and 11 (64-bit).

While BrokenPipe requires local access (e.g., via malware or another exploit), it poses a significant risk as a second-stage attack vector in multi-step compromises. The researcher reported the issue to Valve in March 2026, but the company marked the submission as a duplicate and has not issued a public advisory, CVE assignment, or patch. As of publication, the vulnerability remains a zero-day with no confirmed remediation.

Organizations running Steam on shared or corporate systems face potential privilege-escalation exposure, though no active exploitation has been reported. Defenders are advised to monitor for unusual processes spawned by steamservice.exe and restrict executables running as SYSTEM from user-writable directories.

Source: https://cybersecuritynews.com/steam-windows-0-day-vulnerability/

Valve cybersecurity rating report: https://www.rankiteo.com/company/valve

"id": "VAL1789705419",
"linkid": "valve",
"type": "Vulnerability",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Users running Steam Client '
                                              'Service on Windows 10/11 '
                                              '(64-bit)',
                        'industry': 'Gaming, Software',
                        'name': 'Valve (Steam)',
                        'type': 'Company'}],
 'attack_vector': 'Local',
 'date_detected': '2026-03',
 'date_publicly_disclosed': '2026-09-14',
 'description': 'A newly disclosed zero-day vulnerability in the Steam Client '
                'Service for Windows allows local attackers to escalate '
                'privileges to NT AUTHORITY\\SYSTEM without requiring '
                'administrator credentials, UAC prompts, or Steam '
                'authentication. The flaw stems from a signature-coverage gap '
                'in Steam’s installation workflow, enabling attackers to '
                'redirect execution to malicious code via a caller-controlled '
                'installation root path.',
 'impact': {'brand_reputation_impact': 'Potential reputational damage to '
                                       'Valve/Steam',
            'operational_impact': 'Potential unauthorized SYSTEM-level access '
                                  'on affected systems',
            'systems_affected': 'Windows 10 and 11 (64-bit) with Steam Client '
                                'Service (version 10.96.30.42)'},
 'investigation_status': 'Reported to Valve (marked as duplicate); no patch or '
                         'CVE assigned',
 'lessons_learned': 'The incident highlights the risks of privilege escalation '
                    'vulnerabilities in widely used software and the '
                    'importance of validating caller-controlled paths in '
                    'privileged services.',
 'motivation': 'Proof-of-Concept (PoC) Demonstration',
 'post_incident_analysis': {'root_causes': 'Failure to validate '
                                           'caller-controlled installation '
                                           'root path in Steam’s installation '
                                           'workflow, allowing arbitrary code '
                                           'execution with SYSTEM privileges.'},
 'recommendations': 'Monitor for unusual processes spawned by '
                    'steamservice.exe, restrict executables running as SYSTEM '
                    'from user-writable directories, and apply patches once '
                    'available. Organizations should assess the risk of Steam '
                    'in corporate environments.',
 'references': [{'date_accessed': '2026-09-14',
                 'source': 'Security Researcher (KillaBoi)'}],
 'response': {'enhanced_monitoring': 'Monitor for unusual processes spawned by '
                                     'steamservice.exe and restrict '
                                     'executables running as SYSTEM from '
                                     'user-writable directories'},
 'threat_actor': 'KillaBoi (Security Researcher)',
 'title': 'Windows Zero-Day in Steam Client Service Grants SYSTEM Privileges',
 'type': 'Privilege Escalation',
 'vulnerability_exploited': 'Signature-coverage gap in Steam’s installation '
                            'workflow (failure to validate caller-controlled '
                            'installation root path)'}