Steam Windows 0-Day Vulnerability Allows Users to Silently Escalate to Full SYSTEM Privileges

A newly disclosed Windows zero-day affecting the Steam Client Service can reportedly let a standard local user obtain NT AUTHORITY\SYSTEM privileges without administrator credentials, a User Account Control prompt, Steam authentication, or launching a game.

Researcher KillaBoi published the BrokenPipe proof of concept on September 14, describing local privilege escalation through steamservice.exe, Steam’s privileged Windows service.

The weakness is not a memory-corruption bug or forged signature. According to the technical description, Steam’s service accepts a caller-controlled installation root alongside a genuine Valve-signed install-script VDF, but that path is not protected by the signature.

Steam Windows 0-Day Vulnerability

An unprivileged process can therefore influence where the trusted installation workflow finds a launcher, turning a legitimate signed manifest into a vehicle for privileged code execution.

BrokenPipe first establishes an inter-process communication connection to the Steam Client Service. It invokes IClientInstallUtils::AddInstallScriptToWhiteList with the authentic VDF and an attacker-selected installation root, causing a relocated launcher to become trusted.

A subsequent IClientInstallUtils::RunInstallScript call makes the SYSTEM-level service process the VDF and execute that launcher with its privileges. The technique exploits a signature-coverage gap; it does not modify, forge, or bypass Valve’s signature.

The single-file PowerShell proof of concept embeds the signed VDF as Base64 data and implements the service’s shared-memory IPC client as inline C#. By default, it copies Windows Command Prompt to a relocated launcher.exe path and asks Steam’s service to execute it.

In the demonstration, whoami returns NT AUTHORITY\SYSTEM, while whoami /user reports S-1-5-18, the well-known SID Microsoft assigns to LocalSystem.

Testing reportedly succeeded against Steam version 10.96.30.42 on recent 64-bit Windows 10 and Windows 11 builds. Steam must be installed, its service must be available, and the attacker must already be able to run code as a standard local user.

BrokenPipe is therefore not remote compromise by itself, but it could become a powerful second-stage capability after phishing, malware execution, or exploitation of another vulnerability.

The researcher says Valve had known about the issue since March 2026. Based on reports that the related HackerOne submission was marked as a duplicate and that Valve had not responded to its request for comment.

No public Valve advisory, CVE assignment, or confirmed security update addressing BrokenPipe was identified at publication time, so its zero-day status remains based on the researcher’s disclosure and the apparent absence of a vendor fix.

Until Valve issues guidance, organizations should treat Steam on shared or corporate Windows systems as potential privilege-escalation exposure.

Defenders should inventory Steam installations, remove the client where unnecessary, monitor unusual children of steamservice.exe, and alert when executables run as SYSTEM from user-writable directories. Keeping Steam updated remains important, but administrators should not assume an update mitigates BrokenPipe until Valve confirms remediation.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC