Steam Windows 0-Day: BrokenPipe PoC Silently Escalates Local Users to NT AUTHORITY\SYSTEM via Signed VDF Abuse — No CVE or Patch

A public PowerShell proof of concept named BrokenPipe exploits a signature-coverage flaw in Steam's privileged Windows client service (steamservice.exe), letting any unprivileged local user gain NT AUTHORITY\SYSTEM on fully patched 64-bit Windows 10/11…

Researcher KillaBoi published the BrokenPipe PowerShell proof of concept on September 14, 2026, targeting steamservice.exe, the Steam Client Service that runs as NT AUTHORITY\SYSTEM. The flaw is a signature-coverage gap rather than signature forgery: the service accepts a caller-controlled installation root alongside a genuine Valve-signed install-script VDF, so via the IClientInstallUtils::AddInstallScriptToWhiteList and RunInstallScript IPC calls, the SYSTEM-level service executes a relocated, attacker-chosen launcher, returning whoami output of NT AUTHORITY\SYSTEM (S-1-5-18). Testing reportedly succeeded on Steam Client 10.96.30.42 on recent, fully updated 64-bit Windows 10 and Windows 11 builds. The attack requires only standard local user access — no admin credentials, UAC bypass, signature forgery, Steam login, or modification of Valve-signed files — making it a strong second stage after phishing, malware, or another exploit. Valve was reportedly aware since March 2026 and the HackerOne submission was marked duplicate; no CVE, advisory, or patch exists at publication time. Defenders should inventory Steam installs, remove unneeded clients, alert on SYSTEM processes from user-writable directories, and monitor unusual child processes from steamservice.exe, unexpected IPC activity, and suspicious PowerShell use.

• Affected component: steamservice.exe (Steam Client Service), which runs as NT AUTHORITY\SYSTEM; flaw is a signature-coverage gap, not signature forgery
• Mechanism: IClientInstallUtils::AddInstallScriptToWhiteList and RunInstallScript IPC calls make the SYSTEM service execute an attacker-placed launcher via a genuine Valve-signed install-script VDF that is not bound to a fixed installation…
• Impact: unprivileged local user gains NT AUTHORITY\SYSTEM (SID S-1-5-18); no admin credentials, UAC bypass, signature forgery, Steam login, or modification of Valve-signed files required
• Tested on Steam Client 10.96.30.42 on fully updated/recent 64-bit Windows 10 and Windows 11 builds
• BrokenPipe PowerShell PoC published by researcher KillaBoi on September 14, 2026
• Valve reportedly aware since March 2026; HackerOne report marked duplicate; no CVE, advisory, or patch at publication time
• Defender guidance: inventory Steam installs, remove unneeded clients, alert on SYSTEM processes from user-writable directories, watch for odd child processes from steamservice.exe, unexpected IPC activity, and suspicious PowerShell use