Steam Windows client bugs with public exploit code let a local user become SYSTEM, and a connected Steam peer can run code (Atredis 'Turning the Valve')

On 2026-10-28 Atredis Partners published research on the Steam client for Windows, with full proof-of-concept code on GitHub. Any process, at any integrity level, can connect to the SYSTEM service steamservice.exe over its shared-memory and pipe IPC. Atredis found 4 ways for a local unprivileged user to become SYSTEM. (1) The IClientInstallUtils install-script allowlist trusts executables in user-writable game folders (%INSTALLDIR%). (2) IClientModuleManager legacy module loading runs a DLL from %SteamInstallDir%\legacycompat\ and skips the signature check. (3) Secure-desktop input forwarding can send keystrokes to UAC prompts. (4) InstallVrLinkDongleDriver does not check which INF it installs, so a malicious driver can be loaded (BYOVD). Atredis also found 2 remote code execution bugs: stack overflows in the handlers for peer messages EMsg 9526 (RecvMsgDownloadScheduleChanged) and EMsg 9502 (RecvMsgAppStatus), plus an info leak that defeats ASLR. These are triggered by a connected peer Steam instance, with no click needed once the peer is connected. The write-up does not say which peers can connect or whether they need the same account. At risk: Windows machines with Steam installed, including developer and game-studio workstations, shared or kiosk PCs, and any endpoint where an attacker already has a low-privilege foothold. The bugs were reported to Valve through HackerOne and are 'either patched or exceeded our disclosure timeline'. Which bugs are fixed, and in which client build, is unknown. No CVEs and no exploitation in the wild have been reported.

Summary written from the sources below. Check the originals before acting.