---
title: Steam client flaw allows local privilege escalation to SYSTEM
url: https://www.dataloco.com/en/steam-client-flaw-allows-local-privilege-escalation-to-system
published: 2026-09-19T18:20:34+00:00
language: en
section: Security
source: https://habr.com/ru/news/1082774/?utm_source=habrahabr&utm_medium=rss&utm_campaign=1082774
organizations: Valve, Steam
publisher: Dataloco
---

# Steam client flaw allows local privilege escalation to SYSTEM

A critical zero-day vulnerability named BrokenPipe has been disclosed in the Steam client for Windows, enabling any standard user to silently elevate their privileges to full SYSTEM access. The flaw affects the steamservice.exe component, a Windows service installed alongside the Steam client that typically runs with SYSTEM permissions to perform operations requiring elevated rights on behalf of the client. The vulnerability was identified by a developer known as KillaBoi, who stated that Valve was notified of the issue in March 2026 but has not yet released a fix for the Windows client. The researcher noted that their report on HackerOne was marked as a duplicate, which prompted the public release of a proof-of-concept to encourage a faster resolution from Valve. The BrokenPipe exploit leverages how the Steam Client service processes signed VDF files used for installation scripts.

Specifically, a VDF file may possess a legitimate Valve signature, but the root installation directory, which is controlled by the caller and used by the service, is reportedly not covered by that signature. The proof-of-concept connects to the Steam client service without administrator rights and invokes the IClientInstallUtils::AddInstallScriptToWhiteList function, providing a genuine Valve-signed VDF file along with an attacker-controlled installation location. This action causes the relocated launcher to be treated as trusted. Subsequently, the exploit calls IClientInstallUtils::RunInstallScript, causing the SYSTEM-level Steam service to process the VDF file and execute the selected launcher with its own elevated privileges. The final stage of the proof-of-concept launches the command prompt from the Windows System32 directory as SYSTEM, with the whoami command returning the local system SID S-1-5-18. The developer clarified that the BrokenPipe project does not forge, modify, or bypass the Valve digital signature on the VDF file.

Instead, the vulnerability exploits a gap in what the signature actually covers. The BrokenPipe project was tested on Steam version 10.96.30.42 on modern 64-bit Windows 10 and Windows 11 systems. The vulnerability does not require authentication to Steam to function. However, an attacker must already have code execution access as a local user to exploit BrokenPipe. This requirement reduces the overall criticality of the issue, as common malware, stealers, and remote access tools often seek local privilege escalation vulnerabilities after gaining initial access. A flaw in widely used software like Steam could provide malicious software with a convenient path from limited user privileges to full SYSTEM control.