{"id":"TECH-202610-steam-windows-client-bugs-with-public-exploit-code-let-a-loc","kind":"technique","aliases":[],"related":[],"title":"Steam Windows client bugs with public exploit code let a local user become SYSTEM, and a connected Steam peer can run code (Atredis 'Turning the Valve')","description":null,"summary":"On 2026-10-28 Atredis Partners published research on the Steam client for Windows, with full proof-of-concept code on GitHub. Any process, at any integrity level, can connect to the SYSTEM service steamservice.exe over its shared-memory and pipe IPC. Atredis found 4 ways for a local unprivileged user to become SYSTEM. (1) The IClientInstallUtils install-script allowlist trusts executables in user-writable game folders (%INSTALLDIR%). (2) IClientModuleManager legacy module loading runs a DLL from %SteamInstallDir%\\legacycompat\\ and skips the signature check. (3) Secure-desktop input forwarding can send keystrokes to UAC prompts. (4) InstallVrLinkDongleDriver does not check which INF it installs, so a malicious driver can be loaded (BYOVD). Atredis also found 2 remote code execution bugs: stack overflows in the handlers for peer messages EMsg 9526 (RecvMsgDownloadScheduleChanged) and EMsg 9502 (RecvMsgAppStatus), plus an info leak that defeats ASLR. These are triggered by a connected peer Steam instance, with no click needed once the peer is connected. The write-up does not say which peers can connect or whether they need the same account. At risk: Windows machines with Steam installed, including developer and game-studio workstations, shared or kiosk PCs, and any endpoint where an attacker already has a low-privilege foothold. The bugs were reported to Valve through HackerOne and are 'either patched or exceeded our disclosure timeline'. Which bugs are fixed, and in which client build, is unknown. No CVEs and no exploitation in the wild have been reported.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Steam","fixed":[],"affected":"Steam client for Windows; affected and fixed builds unknown (offsets from build 1773426488)","ecosystem":"vendor"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"- Inventory Windows endpoints with Steam installed: steam.exe or steamservice.exe present, or the Steam Client Service running. Check the Steam client build under Help > About Steam. Fixed builds are unknown.\n- Look for a legacycompat folder under the Steam install directory that holds steamservice.exe or servicecall_<crc>.dll/.in/.out files.\n- Look for pnputil /add-driver run against a steam_stage path under a user's temp folder.\n- Look for unexpected processes started by steamservice.exe from game install folders or %TEMP%\\redist.\n- Look for unexpected values under HKLM\\Software\\Valve\\SteamSecureDesktop.\n- Indicators of compromise: unknown.","fix":"- Update the Steam client to the latest build on every Windows machine. Steam updates itself on restart. The write-up does not confirm which bugs that build fixes.\n- Remove Steam from corporate and server endpoints that do not need it, or block it with application control.\n- Where Steam must stay, treat a local foothold on that machine as a possible path to SYSTEM. Do not run Steam on shared or high-value hosts.\n- Watch for a Valve fix notice, and recheck once Atredis or Valve says which bugs are patched.","status":"open","published_at":"2026-10-28T00:00:00+00:00","first_seen_at":"2026-10-28T21:59:19+00:00","triaged_at":"2026-10-28T21:59:19+00:00","updated_at":"2026-10-28T21:59:23+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':48B '-202610':28A '-28':49B '1':102B '2':118B,166B '2026':47B '3':134B '4':92B,146B '9502':184B '9526':180B 'a':39A 'account':228B 'allowlist':108B 'alreadi':253B 'also':164B 'aslr':192B 'atredi':23A,50B,90B,163B 'attack':252B 'becom':13A,100B 'bug':4A,170B,261B,278B 'bugs':33A 'build':285B 'byovd':162B 'check':133B,150B 'click':204B 'client':3A,32A,57B,284B 'code':8A,22A,37A,66B,168B 'concept':65B 'connect':17A,76B,198B,210B,221B 'cves':289B 'defeat':191B 'desktop':137B 'develop':237B 'disclosur':275B 'dll':125B 'driver':158B 'earli':43B 'early-warn':42B 'either':270B 'emsg':179B,183B 'endpoint':249B 'exceed':273B 'execut':110B,169B 'exploit':7A,36A,292B 'fix':280B 'folder':116B 'foothold':259B 'forward':139B 'found':91B,165B 'full':61B 'game':115B,240B 'game-studio':239B 'github':68B 'hackeron':267B 'handler':175B 'iclientinstallutil':104B 'iclientmodulemanag':119B 'includ':236B 'inf':152B 'info':188B 'input':138B 'instal':106B,154B,235B 'install-script':105B 'installdir':117B 'installvrlinkdongledriv':147B 'instanc':201B 'integr':73B 'ipc':89B 'keystrok':142B 'kiosk':245B 'leak':189B 'legaci':120B 'legacycompat':128B 'let':9A,38A 'level':74B 'load':122B,161B 'loc':40A 'local':11A,96B 'low':257B 'low-privileg':256B 'machin':232B 'malici':157B 'memori':86B 'messag':178B 'modul':121B 'need':205B,225B 'overflow':172B 'partner':51B 'patch':271B 'pcs':246B 'peer':19A,177B,199B,208B,219B 'pipe':88B 'plus':186B 'privileg':258B 'process':70B 'prompt':145B 'proof':63B 'proof-of-concept':62B 'public':6A,35A 'publish':52B 'recvmsgappstatus':185B 'recvmsgdownloadschedulechang':181B 'remot':167B 'report':263B,298B 'research':53B 'risk':230B 'run':21A,123B 'say':217B 'script':107B 'secur':136B 'secure-desktop':135B 'send':141B 'servic':80B 'share':85B,243B 'shared-memori':84B 'signatur':132B 'skip':130B 'stack':171B 'steam':1A,18A,30A,41A,56B,200B,234B 'steam-windows-client-bugs-with-public-exploit-code-let-a-loc':29A 'steaminstalldir':127B 'steamservice.exe':81B 'studio':241B 'system':14A,79B,101B 'tech':27A 'techniqu':45B 'timelin':276B 'trigger':195B 'trust':109B 'turn':24A 'uac':144B 'unknown':287B 'unprivileg':97B 'user':12A,98B,113B 'user-writ':112B 'valv':26A,265B 'warn':44B 'way':93B 'whether':223B 'wild':295B 'window':2A,59B,231B 'windows':31A 'with':34A 'workstat':242B 'writabl':114B 'write':213B 'write-up':212B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202610-steam-windows-client-bugs-with-public-exploit-code-let-a-loc","url":null,"severity":null,"published_at":"2026-10-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-28T21:59:19+00:00","fetched_at":"2026-10-28T21:59:19+00:00","note":null},{"source":"analyst","external_id":"TECH-202610-steam-windows-client-bugs-with-public-exploit-code-let-a-loc:981","url":null,"severity":null,"published_at":"2026-10-28T21:59:23+00:00","modified_at":"2026-10-28T21:59:23+00:00","first_seen_at":"2026-10-28T21:59:23+00:00","fetched_at":"2026-10-28T21:59:23+00:00","note":"Added affected product: Steam client for Windows"}],"documents":[{"id":12479,"url":"https://x.com/_r_netsec/status/2115557557762961652","title":"@_r_netsec: Turning the Valve - Exploiting RCE and LPE in the Steam Platform https://t.co/J1","kind":"post","source":"x","text":"Turning the Valve - Exploiting RCE and LPE in the Steam Platform https://t.co/J1Zq9ZtEkZ\n\nlikes 3 reposts 1","published_at":"2026-10-28T21:33:21+00:00","relation":"describes","confidence":null,"note":null},{"id":12552,"url":"https://www.reddit.com/r/netsec/comments/1xi11fq/turning_the_valve_exploiting_rce_and_lpe_in_the/","title":"r/netsec: Turning the Valve - Exploiting RCE and LPE in the Steam Platform","kind":"post","source":"reddit","text":"Turning the Valve - Exploiting RCE and LPE in the Steam Platform\n\nsubmitted by /u/FILLABUSTA [link] [comments]","published_at":"2026-10-28T21:24:39+00:00","relation":"describes","confidence":null,"note":null},{"id":12592,"url":"https://www.atredis.com/blog/2026/10/28/turning-the-valve/","title":"Turning the Valve - Exploiting RCE and LPE in the Steam Platform (Atredis Partners)","kind":"blog","source":"analyst","text":"Atredis research on the Steam Windows client (steam.exe -> SYSTEM steamservice.exe over shared memory Global\\SteamClientService_SharedMemFile + anonymous pipes; DACL lets any process at any IL connect). 4 LPEs to SYSTEM: (1) IClientInstallUtils AddInstallScriptToWhitelist/RunInstallScript VDF allowlist of user-writable %INSTALLDIR% paths persists in memory; (2) IClientModuleManager CallFunctionAsync legacy module loading writes attacker DLL to %SteamInstallDir%/legacycompat/ and runs steamservice.exe from there, skipping RSA checks; (3) IClientSecureDesktop input ring buffer slots can be marked unencrypted to send keystrokes to UAC prompts; (4) InstallVrLinkDongleDriver INF not checked, TOCTOU before pnputil (BYOVD). 2 RCEs from a connected peer Steam instance: EMsg 9526 RecvMsgDownloadScheduleChanged stack overflow (>200 apps_scheduled entries, RIP control, zero click once peer connected) and EMsg 9502 RecvMsgAppStatus stack overflow (>7 stage_progress entries) plus info leak of 32 uninitialized DWORDs (steamclient64 pointers) defeating ASLR. Reported to Valve via HackerOne; bugs 'either patched or exceeded our disclosure timeline' (per-bug status not stated). Full PoCs on GitHub. Presented in part at BSides PDX 2026. Offsets from build 1773426488. No CVEs, no exploitation in the wild stated.","published_at":"2026-10-28T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}