Valve’s Steam platform was susceptible to zero-click remote code execution between computers signed into the same account.
The findings were detailed by Atredis Partners researcher Bryan Alexander in an October 28 report, following a partial presentation at BSides PDX 2026. The team released proof-of-concept code and reported all the issues through Valve’s HackerOne program.
Atredis says the vulnerabilities it discovered are either patched or past its disclosure deadline. However, the report does not identify the fix status of each issue or provide a complete list of patched versions.
Steam is Valve’s digital storefront and gaming platform, supporting game installation, purchases, and streaming across devices. The research examined both its privileged Windows service and the messages exchanged between Steam clients.
Zero-click attacks through account synchronization
The remote attack surface stems from Steam’s ability to maintain sessions on multiple computers under one account. Those clients exchange synchronization messages through Valve’s Connection Manager infrastructure without requiring Remote Play pairing.
An attacker would need control of a Steam client authenticated to the same account as the target. Once that condition was met, the demonstrated exploit required no further interaction on the receiving computer.
Atredis identified two stack buffer overflows in these communications. One affected download-schedule notifications, where Steam copied an attacker-controlled list of application IDs into a fixed-size stack buffer without checking its length.
The second affected application-status updates. Steam copied progress records into an array with space for seven entries, allowing a message containing additional records to overwrite adjacent stack memory.
The researchers also discovered an information leak in outgoing download-schedule messages. Steam transmitted a fixed number of entries even when fewer were available, exposing uninitialized stack data containing memory addresses.
Those addresses helped the team locate Steam’s client library in memory and develop a working zero-click code execution exploit. Their demonstration used a Windows 10 virtual machine as the attacker and an up-to-date Windows 11 system as the target.
Four routes to higher privileges
The local findings involved Steam’s service, which runs with Windows SYSTEM privileges to handle tasks such as installing game dependencies.
One flaw allowed attackers to abuse installation scripts and an executable allowlist to run a substituted program as SYSTEM. Another affected a legacy module-loading mechanism that could launch an attacker-controlled executable from a user-writable location.
A third issue involved Steam’s secure desktop capture component, which supports interaction with Windows elevation prompts during streaming. Once researchers authorized its input feature, local processes could inject keyboard and mouse events into the secure desktop, allowing automated approval of elevation prompts in the researchers’ tests.
The final finding concerned the installation of the Steam Frame dongle driver. Insufficient validation could allow installation of unintended signed drivers, creating an opportunity for bring-your-own-vulnerable-driver attacks.
Users should keep Steam updated and review account access, particularly unfamiliar authenticated devices. However, because the report provides limited remediation details and Valve hasn’t responded to our requests, CyberInsider couldn’t confirm whether the latest Steam client version protects against every disclosed issue.
Leave a Reply