A recently discovered vulnerability in the Windows Steam Client Service has been reported, permitting local users to gain elevated NT AUTHORITYSYSTEM privileges without needing administrative credentials, a User Account Control prompt, or Steam authentication. This flaw, disclosed by researcher KillaBoi on September 14, is not linked to a memory-corruption bug but involves a misconfigured installation process.
Understanding the Steam Vulnerability
The vulnerability, known as BrokenPipe, exploits a flaw in the steamservice.exe, a component of Steam’s Windows service. This service can be manipulated to accept a user-controlled installation path along with a legitimate Valve-signed install-script VDF. The flaw lies in the fact that the path isn’t secured by the signature, allowing unauthorized access.
By establishing communication with the Steam Client Service, attackers can utilize IClientInstallUtils::AddInstallScriptToWhiteList. This function, when combined with an attacker-chosen installation root, causes the relocated launcher to gain trust. The execution of this script at a SYSTEM privilege level exploits a gap in signature coverage without tampering with Valve’s signature.
Technical Details of the Exploit
The proof of concept, a PowerShell script, embeds the signed VDF as Base64 data and utilizes inline C# to interact with the service’s shared-memory IPC client. It typically copies the Windows Command Prompt to a new launcher path, requesting Steam’s service to execute it. As a result, commands like ‘whoami’ confirm SYSTEM-level access.
Tests have confirmed this exploit on Steam version 10.96.30.42 across recent 64-bit Windows 10 and Windows 11 installations. However, the attacker must already possess the capability to execute code locally. Thus, BrokenPipe doesn’t facilitate remote attacks but could serve as a potent second-stage attack vector following initial compromise through phishing or malware.
Valve’s Response and Mitigation Measures
Researcher reports indicate Valve was informed of this issue in March 2026, but no public advisory, CVE assignment, or security update has been issued by Valve regarding BrokenPipe at this time. As such, its zero-day status remains, pending official confirmation of remediation from Valve.
Organizations are advised to treat Steam installations on shared or corporate Windows systems as potential security risks. Monitoring the Steam Client Service for unusual activities, such as executables running from user-writable directories, is crucial. Until Valve releases a fix, removing unnecessary Steam installations and maintaining up-to-date systems is recommended to mitigate potential privilege escalation threats.
To enhance security operations, integrating threat intelligence context can significantly reduce incident response times and improve the effectiveness of security operations centers (SOCs).
