Steam Windows Vulnerability Lets Users Escalate Privileges to NT AUTHORITY\SYSTEM
BrokenPipe proof of concept achieves NT AUTHORITY\SYSTEM privilege escalation via Steam Client Service's install-script handling on fully patched Windows 10/11.
A published PowerShell proof of concept called BrokenPipe abuses the Steam Client Service (steamservice.exe), which runs as SYSTEM, by leveraging IClientInstallUtils::AddInstallScriptToWhiteList and RunInstallScript: a legitimate Valve-signed VDF install script is not bound to a fixed installation root, so a local user supplies an attacker-controlled directory and gets a whitelisted launcher executed as Local System (SID S-1-5-18). The PoC was tested on Steam Client 10.96.30.42 on fully updated 64-bit Windows 10 and 11 and requires no admin credentials, UAC bypass, signature forgery, Steam login, or modification of Valve-signed files. No CVE or Valve patch is mentioned; defenders should monitor for unusual child processes from steamservice.exe and unexpected IPC activity.
- Steam Client Service executes an attacker-placed launcher with SYSTEM privileges via signed VDF abuse
- Exploit needs no admin credentials, UAC bypass, signature forgery, Steam login, or file tampering
- Defenders should watch for odd child processes from steamservice.exe and suspicious PowerShell use
Full article543 words · extracted from gbhackers.com · click to collapse
A newly published proof of concept called “BrokenPipe” has revealed a local privilege escalation vulnerability in the Steam Client Service on Windows systems.
According to the project’s GitHub repository, this flaw could allow a standard, non-administrative Windows user to make the Steam Client Service launch an executable with NT AUTHORITY\SYSTEM privileges.
The proof of concept was tested on Steam Client version 10.96.30.42 running on fully updated 64-bit installations of Windows 10 and Windows 11.
Steam Windows Vulnerability
The background service for Steam, known as steamservice.exe, operates with SYSTEM-level permissions to facilitate installation, updates, repairs, and other privileged functions.
BrokenPipe targets the way this service processes installation scripts and associated paths. The researcher claims that exploiting this vulnerability does not require the attacker to modify a Valve-signed file, forge a signature, bypass User Account Control, or obtain administrator credentials. Moreover, the exploit does not require a Steam account login or game launch.
The issue revolves around how Valve Data Format (VDF) installation scripts are handled. The Steam Client Service accepts a legitimate, Valve-signed install-script VDF through an IPC-based interface known as IClientInstallUtils::AddInstallScriptToWhiteList.
However, the repository indicates that the signed VDF does not properly bind to or restrict the installation root the caller chooses. Consequently, a local user may be able to provide an attacker-controlled installation directory while still utilizing a legitimate signed script.
BrokenPipe exploits this gap in signature coverage by placing a launcher at an alternate path and allowing the privileged service to recognize it through the installation-script workflow.
The service then processes a request through IClientInstallUtils::RunInstallScript, selects the whitelisted launcher, and executes it under the SYSTEM security context.
In the published demonstration, the resulting process reportedly runs with the Local System SID (S-1-5-18), confirming SYSTEM-level execution.
The project is distributed as a self-contained PowerShell proof of concept, rather than a compiled C++ version, which was previously maintained in a legacy branch.
The script embeds the genuine Valve-signed VDF as Base64 data. It includes inline C# code to communicate with the Steam Client Service via shared-memory IPC.
The author emphasizes that the implementation aims to showcase the privilege boundary failure rather than modify Steam binaries or tamper with Valve signatures.
This finding matters for defenders because local privilege escalation can turn access gained through malware, phishing, a compromised low-privilege account, or other initial access methods into complete control of a Windows endpoint.
SYSTEM execution can enable threat actors to disable security measures, access protected system resources, establish persistence, dump credentials, or deploy ransomware more effectively.
Organizations should monitor for unusual child processes originating from steamservice.exe, particularly command interpreters, scripting engines, or unsigned executables launched from nonstandard directories.
Security teams should also investigate unexpected Steam service IPC activity, suspicious PowerShell execution on endpoints where Steam is installed, and file copies involving Windows binaries placed in temporary or user-writable locations.
Additionally, administrators should restrict Steam installations on enterprise systems where they are not required for business purposes and apply any remediation or updates Valve releases once the issue is addressed.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.
Text extracted automatically; images, tables and formatting may be missing. Original: https://gbhackers.com/steam-windows-vulnerability/