A critical zero-day vulnerability has been disclosed in the Steam Client Service for Windows, enabling a standard local user—without administrator rights or triggering User Account Control—to escalate privileges to NT AUTHORITY\SYSTEM. That means a non-admin could gain full system control simply by leveraging the flaw in steamservice.exe.
How BrokenPipe Works
The exploit, dubbed “BrokenPipe,” was released on GitHub on September 14 by a researcher named KillaBoi. It abuses Steam’s privileged Windows service to reassign an installer’s root directory—chosen by the attacker—while using an authentic VDF (Valve’s install-script format) that is signed by Valve. The vulnerability arises because the path to the installer root isn’t covered by the signature verification, leaving room for misuse.
In practice, a standard user process first uses Steam’s IClientInstallUtils::AddInstallScriptToWhiteList to whitelist a legitimate VDF alongside an attacker-controlled installation root. Then, through IClientInstallUtils::RunInstallScript, that VDF is processed by the Steam service, executing a relocated launcher with SYSTEM-level privileges. The proof-of-concept embeds the signed VDF in Base64 and creates a launcher.exe in the attacker’s chosen folder—when run, commands like whoami return NT AUTHORITY\SYSTEM.
Who’s Affected, What’s Known
BrokenPipe has been confirmed to work against Steam version 10.96.30.42 on recent 64-bit builds of Windows 10 and Windows 11. To exploit it, Steam must be installed and its service must be running. The attacker doesn’t need to already have admin rights—they only need the ability to run code as a standard user.
The researcher said Valve was made aware of the issue as early as March 2026. However, at the time of the exploit’s public release, there was no official advisory, no CVE identifier, and no confirmed patch from Valve—leaving the issue officially unmitigated.
Mitigation & Security Best Practices
Until Valve issues an update, Steam on shared or corporate machines should be treated as a serious risk. It’s recommended to audit all Steam installations and remove the client where it’s not needed. Monitor for unexpected children processes of steamservice.exe and keep an eye on executables running as SYSTEM that stem from user-writable directories. While ensuring Steam is kept up to date is good practice, there’s no guarantee future updates will fix BrokenPipe unless verification comes directly from Valve.
This vulnerability is highly dangerous when chained with other compromises—say phishing or malware—since it doesn’t allow remote takeover by itself, but can be devastating once invasive code is already on a system.
What this means: This isn’t just another Steam bug—it highlights a gap in how signed components trust files outside of signature enforcement, and underscores the risk in services with elevated privileges. Every organization relying on Windows machines with Steam installed should treat this zero-day seriously. Expect pressure on Valve to either confirm and patch this quickly or provide detailed guidance. Watch for incoming CVEs, security advisories, and possible temporary workarounds. Attack pathways that escalate to SYSTEM level are among the most critical, and this one demands immediate attention.
