CVE-2019-15316

PoC ×2—

CVSS 3.0

7.0 high

EPSS

<1%p38

Published

Aug 21, 2019 (Aug 21, 2019)

Modified

Jun 17, 2026

Description

Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition.

Vendors: valvesoftware
Products: steam client
Weakness: CWE-367, CWE-732
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.