www.it-connect.fr
Steam Vulnerabilities Exposed Zero-Click Remote Code Execution on PCs
Two PCs connected to the same Steam account were all it took to execute remote code on one of them, with no click required from the victim. Researchers at Atredis Partners have revealed a zero-click flaw in Steam, but that is not all.
On October 28, 2026, Bryan Alexander, a researcher at Atredis Partners, published a technical report titled Turning the Valve, focused on several vulnerabilities discovered in the Steam client on Windows. Part of the findings were presented at BSides PDX 2026, and the PoCs were also published on Atredis's GitHub repository.
According to Atredis, Steam has between 35 and 40 million daily active users, making it a platform with global reach. Last August, I also published an article about the Metal Gear Online 3 flaw that allowed a Steam lobby host to execute code on players' PCs. This time, it is the Steam client itself that is affected by these security flaws.
Remote Code Execution With No Click Required
If you use Steam, you know that a Steam account can be signed in on multiple machines at the same time. You only need to log in with your credentials on each device. To synchronize, clients exchange messages through Valve's Connection Manager infrastructure. It is within this mechanism that the researchers discovered two initial flaws:
- Download scheduling: message 9526 copies a list of application IDs into a fixed-size structure without any length check. Beyond 200 entries, the return address is overwritten.
- Application status: message 9502 copies progress records into an array of 7 entries. Sending more than that makes it possible to control the RIP register.
These memory buffer overflows make it possible to hijack Steam's execution, but the attacker still needs to know where Steam's code is located in memory, which Windows randomizes using a protection called ASLR. A third flaw provides that information. When a Steam client shares its scheduled downloads list with the other machines on the account, it always sends 32 entries, even if it has fewer. Empty slots are filled with leftovers from memory, including internal Steam addresses.
The attacker only needs to trigger this transmission to obtain this memory "map", then reuse parts of Steam's code to launch the program of their choice on the other device. The demonstration was carried out from a Windows 10 VM against a fully up-to-date Windows 11 PC.
But as you probably already guessed, there is an important prerequisite: the attacker must control an authenticated Steam client on the same account as the victim. In other words, they first need to steal the account and sign in to it (which can be done via an infostealer, since recurring campaigns exist).
Four Paths to SYSTEM Privileges
The second major part of the report concerns steamservice.exe, Steam's service that runs as SYSTEM to install game dependencies. Because of overly broad permissions, any process can send requests to it, regardless of its integrity level.
- Installation scripts: Steam relies on Valve-signed scripts to install the components required by games. The researchers showed that this mechanism could be abused to execute a completely different program with SYSTEM privileges. They notably reused a Valve-signed VDF script (the one for BioShock Infinite in the demonstration).
- Legacy compatibility function: the service launches a program stored in a user-modifiable folder without checking what it actually runs.
- Secure desktop: for Remote Play, Steam can forward keyboard and mouse input to the Windows secure desktop, the isolated environment where privilege elevation prompts (UAC) appear. Once this option is approved by the user, any program in the user's session can use it to approve these prompts on its own. "The architecture breaks the isolation boundary imposed by Windows in the secure desktop environment," Bryan Alexander summarizes.
- Steam Frame dongle driver: the function that installs the wireless dongle driver does not verify that it is the correct driver. An attacker can therefore install a different signed but vulnerable driver. This is the principle behind a BYOVD (Bring Your Own Vulnerable Driver) attack, a technique favored by ransomware operators (example: Akira hijacking legitimate Windows drivers to disable Windows Defender).
Note: according to Atredis, two of these privilege escalations were classified as duplicates, and a third had already been reported by another researcher.
Have the Vulnerabilities Been Patched?
Atredis says that all of the flaws are either fixed or have reached the end of its disclosure window. However, the report does not specify the status of each flaw, the affected versions, or any CVEs. In other words, there is nothing to indicate that patches for these flaws are present in the latest version of the Steam client...
Ideally, update Steam on Windows, check the list of authorized devices on your account, and above all, enable multi-factor authentication.
