Reported by 3 outlets
Steam vulnerability on Windows lets any normal user silently escalate to SYSTEM
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.14 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Steam vulnerability on Windows lets any normal user silently escalate to SYSTEM
x.com · 29d ago · September 15th, 2026
A newly disclosed local privilege escalation (LPE) in the Steam Client Service affects Windows 10 and 11. Any standard, unprivileged user can get a SYSTEM-level shell — no admin rights, no UAC prompt, no game launch required. The root cause is a signature coverage gap in Steam's installation verification. The exploit passes a caller-controlled path that Valve's signed VDF never actually covers, letting you run code as SYSTEM without touching or forging the signature at all. Tested on Steam version 10.96.30.42. Tagging this as educational/defensive research, but worth mentioning that Valve were notified about this months ago. Source: https://x.com/bet3rd/status/2099621646155821497 submitted by /u/xBeT3rDx [link] [comments]
via reddit r/cybersecurity: Steam vulnerability on Windows lets any normal user silently escalate to SYSTEM
-
update from github.com
BrokenPipe: a Steam vulnerability (0-Day) on Windows lets any normal user silently escalate to full SYSTEM privileges https:// lemmy.ca/post
github.com · 27d ago · September 16th, 2026
BrokenPipe: a Steam vulnerability (0-Day) on Windows lets any normal user silently escalate to full SYSTEM privileges https:// lemmy.ca/post
via Mastodon https://github.com/KillaBoi/BrokenPipe#brokenpipe---steam-client-service-lpe-vulnerability
-
update from gbhackers.com
Steam Windows Vulnerability Lets Users Escalate Privileges to NT AUTHORITY\SYSTEM
gbhackers.com · 26d ago · September 18th, 2026
A newly published proof of concept called “BrokenPipe” has revealed a local privilege escalation vulnerability in the Steam Client Service on Windows systems. According to the project’s GitHub repository, this flaw could allow a standard, non-administrative Windows user to make the Steam Client Service launch an executable with NT AUTHORITY\SYSTEM privileges. The proof of concept […] The post Steam Windows Vulnerability Lets Users Escalate Privileges to NT AUTHORITY\SYSTEM appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .