Steam Windows 0-Day Vulnerability Allows Users to Silently Escalate to Full SYSTEM Privileges
A public BrokenPipe PoC exploits a signature-coverage flaw in Steam's Windows service, letting unprivileged local users gain NT AUTHORITY\SYSTEM without a patch or CVE.
Researcher KillaBoi published the BrokenPipe PowerShell proof of concept on September 14, 2026, targeting steamservice.exe, Steam's privileged Windows client service. The flaw is a signature-coverage gap: the service accepts a caller-controlled installation root alongside a genuine Valve-signed install-script VDF, causing the SYSTEM-level service to execute a relocated attacker-chosen launcher. Testing reportedly succeeded on Steam 10.96.30.42 on recent 64-bit Windows 10 and Windows 11 builds, returning whoami output of NT AUTHORITY\SYSTEM (S-1-5-18). Valve was reportedly aware since March 2026, the HackerOne submission was marked duplicate, and no CVE, advisory, or fix exists at publication time.
- BrokenPipe uses IClientInstallUtils::AddInstallScriptToWhiteList and RunInstallScript IPC calls to make the SYSTEM service execute an attacker-placed launcher.
- It exploits a signature-coverage gap, not signature forgery, turning a genuine Valve-signed VDF into a privileged execution vehicle.
- Requires only standard local user access, making it a strong second stage after phishing, malware, or another exploit.
- Valve allegedly aware since March 2026; HackerOne report marked duplicate; no CVE, advisory, or patch at publication.
- Defenders should inventory Steam installs, remove unneeded clients, and alert on SYSTEM processes from user-writable directories.
- Products
- SteamBrokenPipe
- Organizations
- HackerOne
From the original article
2 min read at cybersecuritynews.com
A newly disclosed Windows zero-day affecting the Steam Client Service can reportedly let a standard local user obtain NT AUTHORITY\SYSTEM privileges without administrator credentials, a User Account Control prompt, Steam authentication, or launching a game. Researcher KillaBoi published the BrokenPipe proof of concept on September 14, describing local privilege escalation through steamservice.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.