Steam Windows 0-Day 'BrokenPipe' Allows Local Privilege Escalation to SYSTEM
A zero-day vulnerability in Valve's Steam client service for Windows, dubbed 'BrokenPipe,' allows unprivileged local users to escalate privileges to SYSTEM.
A critical zero-day vulnerability, named BrokenPipe, has been discovered in the Windows client service for Valve's popular gaming platform, Steam. This flaw allows a local user with standard privileges to escalate their access to the highest level, NT AUTHORITY\SYSTEM, without requiring administrator credentials, a User Account Control prompt, or even launching a game.
The vulnerability, detailed by researcher KillaBoi, exploits a specific weakness in how the Steam service handles installation scripts. Instead of a memory corruption bug or a forged signature, BrokenPipe leverages a signature coverage gap. The Steam Client Service accepts a caller-controlled installation root alongside a legitimate Valve-signed install-script VDF. However, this path is not adequately protected by the signature, allowing an unprivileged process to trick the trusted installation workflow into executing arbitrary code.
To exploit BrokenPipe, an attacker first establishes an inter-process communication (IPC) connection to the Steam Client Service. They then invoke the IClientInstallUtils::AddInstallScriptToWhiteList function, providing both the authentic VDF and an attacker-selected installation root. This manipulates the service into trusting a relocated launcher, which is then executed with SYSTEM privileges via a subsequent call to IClientInstallUtils::RunInstallScript.
The proof-of-concept, delivered as a single-file PowerShell script, embeds the signed VDF and includes inline C# code to act as the IPC client. By default, it copies the Windows Command Prompt (cmd.exe) to a malicious launcher.exe path and instructs the Steam service to execute it, resulting in SYSTEM-level command execution. Testing has confirmed successful exploitation on recent 64-bit Windows 10 and Windows 11 builds with Steam version 10.96.30.42.
While BrokenPipe requires existing local access and cannot be exploited remotely on its own, it presents a significant threat as a second-stage attack vector. Following initial compromise through methods like phishing, malware execution, or exploitation of another vulnerability, this flaw could be used to gain complete control over a targeted Windows system.
According to reports, Valve has been aware of this issue since March 2026. However, as of the researcher's disclosure, no official patch, CVE assignment, or public advisory has been released, solidifying its zero-day status. This lack of a vendor fix means organizations should consider all Steam installations on corporate or shared Windows environments as potential privilege escalation exposure.
Until Valve provides a confirmed security update, security teams are advised to inventory Steam installations, remove the client where not essential, and monitor for unusual processes launched by steamservice.exe. Additionally, alerts should be triggered for any executables running as SYSTEM from user-writable directories. While keeping Steam updated is generally good practice, administrators should not assume an update automatically mitigates BrokenPipe without explicit confirmation from Valve.