A security researcher going by the handle KillaBoi published a working exploit on September 14, 2026, for a flaw in Steam’s Windows client service that lets any standard local user seize full NT AUTHORITY\SYSTEM control of a PC. No admin password. No UAC prompt. No Steam login required. Ten days later, Valve still has not shipped a patch, assigned a CVE, or issued a public advisory, even though the company was reportedly notified of the bug back in March 2026, according to Cybersecurity News’ original writeup. The flaw, nicknamed BrokenPipe, targets steamservice.exe, the privileged background process that ships with every Steam installation on Windows 10 and Windows 11.
For a platform that sits on hundreds of millions of Windows machines, from home gaming rigs to shared PCs in internet cafés and college labs, an unpatched local privilege-escalation bug in a component that runs with SYSTEM rights is a serious problem, even if it is not the kind of flaw that lets a stranger break in from across the internet. Here is what BrokenPipe actually does, why Valve has not fixed it yet, and what it means for the roughly 130 million monthly active Steam users who never asked to become part of a live vulnerability-disclosure dispute. For broader background on how privilege-escalation bugs fit into the current threat landscape, see our cybersecurity threats coverage.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is the Steam BrokenPipe Vulnerability?
BrokenPipe is the name KillaBoi gave to a local privilege-escalation vulnerability in Steam’s Windows Client Service. The service, steamservice.exe, runs continuously in the background with SYSTEM-level privileges, Windows’ highest local access tier, so that Steam can install games, manage drivers, and handle background updates without repeatedly prompting the user for admin approval.
The problem sits in how that privileged service handles installation scripts. Steam signs its install-script VDF manifest files cryptographically, and the service checks that signature before trusting a script. According to the researcher’s published proof of concept, the verification covers the content of the script but does not properly bind that signed content to the installation-root path the caller supplies. That gap lets a standard, non-administrator user redirect the install path to a location they control, drop a malicious executable there, and have the SYSTEM-level Steam service launch it for them. The published demonstration produces a whoami output identifying NT AUTHORITY\SYSTEM (security identifier S-1-5-18), confirming full local system takeover.
What makes BrokenPipe notable next to routine local bugs is the combination of conditions it skips. It works silently, meaning it does not trigger the User Account Control prompt Windows normally shows before a privilege change. It does not need administrator credentials. It does not require the victim to be logged into Steam, or even for a game to be running. SC Media’s September 2026 coverage of the flaw boiled the requirements down to a single prior condition: the attacker already needs some form of standard-user code execution on the machine, whether through malware, a shared login, or physical access.
How the Exploit Chain Works
Based on the technical write-up KillaBoi posted alongside the proof of concept, the attack chain runs in four steps. It starts with something completely legitimate: Steam’s service will accept a genuine, Valve-signed installation script. Where it breaks down is in what that script is allowed to point to. Security outlet Cyber Insider, covering the flaw in September 2026, distilled the exploit down to the interaction between just two installation-script components: a cryptographically signed VDF manifest and an attacker-controlled installation path that the signature never actually covers.
Step-by-step breakdown
- The Steam Client Service accepts a valid, Valve-signed install-script VDF file through its inter-process communication (IPC) interface.
- The caller also supplies an installation-root path, and that path is not actually covered by the cryptographic signature check.
- A standard local user places a malicious launcher executable in that attacker-controlled path, exploiting the gap between signed content and unsigned path binding.
- The attacker calls into the service using functions reported as
IClientInstallUtils::AddInstallScriptToWhiteListandRunInstallScript, andsteamservice.exeexecutes the attacker’s launcher with full SYSTEM privileges.
Security outlet SC World described the result plainly in its coverage: the flaw lets a standard user escalate to full SYSTEM rights without administrator credentials or a UAC prompt. Coverage from GBHackers, citing KillaBoi’s GitHub repository, framed the issue the same way, noting that the Steam Client Service could be made to launch an attacker-chosen executable at the highest privilege level available on a Windows machine. Windows itself defines SYSTEM as its top local account tier in Microsoft’s own access-control documentation, which is why a successful escalation to that level is treated as a full compromise rather than a partial one. The affected version cited in multiple reports is Steam client build 10.96.30.42, running on 64-bit Windows 10 and Windows 11.
Reported exploit outcome (from KillaBoi's public proof of concept):
C:\Users\standarduser> whoami
nt authority\system
No administrator prompt. No credential entry. No Steam login required.It is worth being precise about what this bug is not. BrokenPipe is not a remote code execution flaw that lets an attacker reach into a Steam user’s PC over the internet, and it is not evidence that Valve’s servers or Steam accounts were compromised. It requires local code execution as a starting point, which puts it in the same broad category as decades of privilege-escalation bugs found in background services across the software industry. September 2026 proof-of-concept testing reproduced the escalation consistently, with the command prompt reporting a clean jump from a standard account to NT AUTHORITY\SYSTEM every time. The severity comes from what happens after that starting point: a foothold that would normally be limited to a standard user’s own files and settings becomes a foothold with total control of the operating system.
Timeline: From a March Disclosure to a September Publication
The dispute over BrokenPipe is as much about disclosure process as it is about code. According to reporting reviewed after the proof of concept went live, KillaBoi first reported the flaw to Valve in March 2026, reportedly through the company’s HackerOne bug bounty program. The researcher says the submission was closed as a duplicate of an existing report, without a fix shipping in the roughly six months that followed. Frustrated by the lack of movement, KillaBoi published the full technical write-up and working proof of concept on September 14, 2026.
That gap sits inside a well-worn debate in the vulnerability research community. Researchers who go public after months of silence argue that public pressure is often the only thing that moves a vendor. Vendors, for their part, often argue that duplicate-marking reflects an internal queue rather than a dismissal, and that public disclosure before a patch ships puts users at needless risk in the meantime. Cybersecurity News, which broke wide coverage of the flaw in its September 21 weekly newsletter roundup, grouped BrokenPipe alongside other September disclosures including a Cisco vulnerability and the BragJack AI browser-agent attack, underscoring how routine this kind of disclosure standoff has become across the industry.
As of September 24, 2026, ten days after publication and roughly six months after the original report, there is still no CVE identifier attached to BrokenPipe, no CVSS severity score, and no public Valve security advisory. Vulnerability-tracking database Codekeeper, monitoring the disclosure through September 2026, lists the same three gaps, no CVE, no CVSS score, and no confirmed Valve patch, as still open. Valve has not issued a statement confirming or denying the vulnerability’s scope through any channel reviewed in current reporting.
Why an Unpatched Flaw Still Matters for Local Privilege Escalation
It is tempting to read local privilege-escalation bugs as a lesser category of vulnerability, since they cannot be triggered by a stranger on the other side of the world with no access to the machine at all. That framing undersells how attackers actually operate. Most real-world intrusions do not start with a single remote exploit that hands over full control in one step. They start small: a phishing email that drops a low-privilege payload, a malicious browser extension, a compromised download, or physical access to an unlocked shared computer. The second stage of that chain is almost always privilege escalation, turning a limited foothold into full control.
A SYSTEM-level local privilege-escalation bug in a component installed on a huge share of Windows gaming PCs is exactly the kind of second-stage tool that malware authors look for. Once elevated to SYSTEM, an attacker can disable security software, install kernel-level rootkits, read credentials from memory, and persist across reboots in ways a standard user account cannot. That is precisely why the flaw was already being tracked by threat-intelligence aggregators like ZeroHour and HawkEye within days of publication, both of which log the bug under their vulnerability and privilege-escalation categories rather than treating it as a low-priority curiosity.
BrokenPipe in Context: How It Compares to Past Steam Vulnerabilities
Steam’s Windows client has a long history of privilege-escalation research, largely because it is one of the most widely installed pieces of software that runs a privileged background service on ordinary consumer machines. Independent researcher Vasily Kravets published a string of local privilege-escalation bugs in the Steam client between 2018 and 2019, several of which also abused the trust relationship between Steam’s unprivileged front-end and its SYSTEM-level service process. Steam’s overlay component, GameOverlayUI, has separately drawn scrutiny across multiple disclosure rounds for code-handling issues tied to its browser-based rendering layer. The table below places BrokenPipe next to that history.
| Vulnerability | Disclosed | Privilege Path | Patch Status (at report time) |
|---|---|---|---|
| BrokenPipe (steamservice.exe) | PoC published Sept. 14, 2026 | Standard user → SYSTEM via signed VDF install-path abuse | Unpatched, no CVE, as of Sept. 24, 2026 |
| Vasily Kravets Steam client bugs | 2018–2019 | Standard user → SYSTEM via Steam service trust flaws | Patched by Valve within weeks of disclosure |
| GameOverlayUI-related flaws | Multiple rounds, early 2020s | Overlay/browser-rendering surface issues | Patched in subsequent Steam client updates |
| 2023 Steam client-side RCE concerns | 2023 | Client-side content-handling issues | Addressed via client updates, per contemporaneous reporting |
What stands out is not that Steam has a vulnerability, since every major software platform with a privileged local service eventually does. What stands out is the response gap. Valve has historically patched local privilege-escalation reports from independent researchers like Kravets within a matter of weeks. BrokenPipe has now gone roughly six months from initial report to public proof of concept with no fix, no CVE, and no advisory, a considerably longer window than the pattern set by the company’s earlier disclosure history.
Who Is Actually at Risk
Current reporting does not offer a precise count of vulnerable installations, and no source has published an authoritative, current Steam total-user figure tied specifically to this disclosure. What is clear from the technical description is the shape of the exposure. Every 64-bit Windows 10 or Windows 11 machine running the affected Steam client build, 10.96.30.42 at the time of disclosure, has the vulnerable service present, whether or not a game is actively running.
The population that faces genuine practical risk is narrower than every Steam install. Because exploitation requires local code execution as a starting point, the highest-risk environments are:
- Shared and public PCs, including internet cafés, LAN centers, university computer labs, and library terminals where Steam is installed and multiple people log in with standard accounts.
- Machines already compromised by low-privilege malware, where BrokenPipe becomes a second-stage escalation tool rather than the initial infection vector.
- Corporate or school-managed Windows fleets where employees or students have installed Steam on standard, non-administrator accounts, creating an unexpected path to full local admin.
- Family or multi-user home PCs where a child’s or guest’s standard account could be used to gain control of the entire machine.
Casual single-user home gaming PCs, where the primary account already has administrator rights, see a smaller practical security delta from BrokenPipe specifically, though the underlying design flaw is still real and could still be chained with other malware.
Market Impact: Valve, PC Gaming, and Enterprise IT Exposure
Valve is a privately held company, so there is no stock price to move on disclosure news the way a public security incident might hit a listed vendor. That does not mean the fallout is contained to security forums. Steam is the dominant PC game storefront and launcher, and its footprint stretches well beyond consumer bedrooms into internet cafés across Asia, esports training centers, university labs, and increasingly bring-your-own-device corporate environments where employees game on lunch breaks. Any of those shared-machine contexts turns a local privilege-escalation bug from a theoretical footnote into an operational concern for whoever manages that hardware.
The timing compounds the pressure. Reporting from Bleeping Computer this same month covered a separate incident in which Valve notified Steam hardware customers in Europe that their data had been stolen after attackers compromised its shipping partner, CEVA Logistics. That breach is unrelated to BrokenPipe technically, involving a third-party logistics vendor rather than the Steam client itself, but the two stories landing in the same news cycle put Valve’s security posture under a harsher spotlight than either incident would draw alone. For a company that has built two decades of trust around Steam as the default place PC gamers hand over payment details, personal data, and now, implicitly, root-level trust in a background Windows service, an extended unpatched-vulnerability window is reputational risk even without a confirmed breach tied to BrokenPipe itself.
How BrokenPipe Stacks Up Against Other Game Launcher Security Records
Steam is not the only game launcher that installs a privileged background service on Windows. Epic Games Launcher, the EA App, Ubisoft Connect, and Battle.net all ship similar helper services to manage installs, updates, and anti-cheat integration, and each has drawn its own security scrutiny over the years for the same structural reason: a privileged local service is a high-value target whenever the trust boundary between it and an unprivileged front end is not airtight.
| Launcher | Privileged Background Service | Primary Historical Risk Pattern | Current Disclosure (Sept. 2026) |
|---|---|---|---|
| Steam | steamservice.exe (SYSTEM) | Install-script trust and IPC-boundary flaws | BrokenPipe, unpatched, no CVE |
| Epic Games Launcher | Epic Online Services background helper | Update-mechanism and service-permission issues | No comparable active disclosure identified in current reporting |
| EA App | EA Desktop background service | Installer and update-service permission scope | No comparable active disclosure identified in current reporting |
| Ubisoft Connect | Ubisoft Connect service | DRM and update-service trust boundary | No comparable active disclosure identified in current reporting |
| Battle.net | Battle.net Update Agent | Update-agent privilege handling | No comparable active disclosure identified in current reporting |
None of this means rival launchers are inherently safer, only that no comparably documented, currently unpatched privilege-escalation flaw has surfaced in public reporting for those services this month. The structural risk, a SYSTEM-level helper process paired with an unprivileged, internet-facing front end, is common to the entire category of game launchers, and BrokenPipe is best read as a reminder that the category deserves more routine, adversarial security review, not as proof that Steam is uniquely exposed among its peers.
The Bug Bounty Bottleneck: Why “Duplicate” Reports Become Public Disclosures
KillaBoi’s account of the March 2026 report being closed as a duplicate touches a recurring friction point in vulnerability disclosure programs generally. HackerOne and similar bug bounty platforms handle enormous submission volumes, and triage teams routinely close reports that appear to overlap with an existing internal ticket, sometimes correctly and sometimes not. From a researcher’s perspective, a duplicate closure with no fix timeline and no further communication for months looks indistinguishable from a company quietly shelving a real problem.
That ambiguity is exactly why researchers increasingly default to public proof-of-concept releases once they judge a reasonable disclosure window has passed. Ninety days is a common informal industry benchmark popularized by groups like Google Project Zero. A six-month gap between report and public release, as reported in the BrokenPipe case, sits well past that window. Whether or not Valve’s internal ticket genuinely duplicated an existing fix already in progress, the optics of a still-unpatched, publicly demonstrated SYSTEM-level exploit six months later put the company in a difficult position regardless of the internal explanation.
What PC Gamers and IT Administrators Should Do Right Now
With no official patch available as of September 24, 2026, mitigation falls on individual users and system administrators rather than a simple software update. None of the following steps fully closes the underlying flaw, since only a Valve-issued fix to steamservice.exe can do that, but each reduces practical exposure.
- On shared or public machines, restrict which accounts can install or launch Steam, and treat any standard-user account on a Steam-equipped PC as a potential path to full system control until a patch ships.
- Enterprise and school IT teams should inventory which managed Windows devices have Steam installed, since it may be present on machines where it was never officially sanctioned software.
- Keep endpoint detection and response tooling active and updated, since most real-world exploitation of a bug like this would follow an initial low-privilege compromise, not arrive as the first-stage attack.
- Watch Valve’s official channels and the Steam community security forums closely for a patched client build, and apply it immediately once released.
- Avoid running unfamiliar executables or scripts on any account, standard or otherwise, since BrokenPipe’s practical danger only materializes once an attacker already has some form of code execution.
Readers who already suspect unauthorized access to their account, separate from this specific local exploit, can walk through Steam account recovery steps to secure logins and revoke unfamiliar sessions. Teams running dedicated multiplayer infrastructure alongside Steam should also revisit broader game server hardening practices, since the same shared-machine logic that makes BrokenPipe risky applies to poorly segmented server environments.
Historical Context: A Decade of Privileged Game Client Services Under Scrutiny
Local privilege-escalation research on consumer software is not a new phenomenon, but the gaming category has become an increasingly popular target for exactly the reason Steam illustrates: these are some of the most widely deployed pieces of software on ordinary Windows PCs, often installed with elevated service permissions that go largely unexamined by end users. Kravets’ 2018-2019 Steam findings established the pattern years ago, showing that the gap between an unprivileged Steam client UI and its SYSTEM-level background service was a repeatable class of bug rather than a one-off mistake.
What has changed since then is the broader threat landscape around Windows privilege escalation generally. Reporting this same month on unrelated flaws, including a widely covered Microsoft Defender zero-day with no CVE and no patch weeks after disclosure, and a Linux kernel bug tracked as CVE-2026-43502 that had reportedly existed since 2018 before discovery, shows that long-lived, high-severity local privilege bugs sitting undetected or unpatched for extended periods is not unique to Valve. It is a pattern playing out across major platforms simultaneously in 2026, driven partly by more researchers actively hunting this bug class and partly by the sheer accumulated complexity of decades-old codebases.
Predictions: What Happens Next
Based on Valve’s historical patch cadence for earlier Steam client vulnerabilities and the public pressure now building around BrokenPipe, several outcomes look likely in the coming weeks.
- Valve ships a patched Steam client build addressing the signature-coverage gap within the next several weeks, following the pattern of its earlier, faster responses to Kravets-era disclosures, now under heavier public scrutiny than a routine bug report.
- A CVE identifier gets assigned to BrokenPipe in the near term, given the volume of security outlets, including Cybersecurity News, GBHackers, and SC World, already treating it as a tracked, named vulnerability rather than an obscure researcher blog post.
- Expect renewed public debate about HackerOne triage practices at major gaming companies, with researchers citing BrokenPipe as a case study for why duplicate-marked reports deserve clearer status communication.
- Other researchers will likely take a closer look at competing launchers’ privileged services in the wake of this disclosure, since public attention tends to draw follow-on research into an entire software category once one player is shown to have a weak spot.
- Enterprise and education-sector IT policies around consumer game launchers on managed devices are likely to tighten modestly, with more organizations formally blocking or sandboxing Steam installs on shared machines regardless of whether a patch has shipped.
The Bigger Picture: Game Launchers as an Overlooked Attack Surface
Game launchers occupy an unusual security position. They are consumer entertainment software, so they rarely get the same hardening scrutiny that enterprise-facing tools like Cisco’s networking gear draw after a major vulnerability. But functionally, they are privileged system services running continuously in the background of hundreds of millions of PCs, many of which also handle sensitive personal and financial data through the same machine. BrokenPipe is a useful, if uncomfortable, reminder that the line between gaming software and security-critical infrastructure is thinner than most users assume.
The practical lesson for the platform ecosystem is not that Steam is unusually careless. It is that any software vendor operating a privileged background service on a consumer-scale install base is one signature-verification gap away from a story like this one. Whether Valve’s eventual fix and disclosure timeline sets a better precedent, or reinforces frustration among the researcher community, will shape how the next launcher-level bug gets reported, and whether it gets reported quietly or in public.
Frequently Asked Questions
Is my Steam account at risk of being hacked because of BrokenPipe?
No. BrokenPipe is a local Windows privilege-escalation flaw, not an account takeover or remote login exploit. It cannot be used to log into your Steam account from another location. The risk is to the Windows PC itself, not to your Steam credentials directly.
Do I need to uninstall Steam until a patch is released?
For a typical single-user home PC where you are already the administrator, current reporting does not indicate a strong practical need to uninstall Steam. The bug matters most on shared, public, or managed multi-user machines where standard, non-administrator accounts are used.
Has Valve confirmed or fixed the BrokenPipe vulnerability?
As of September 24, 2026, no public Valve advisory, patch, or CVE assignment had been identified in available reporting, despite the researcher stating Valve was notified in March 2026.
What Steam version is affected by BrokenPipe?
Reports cite Steam client build 10.96.30.42 on 64-bit Windows 10 and Windows 11 as the affected version at the time of disclosure.
Does BrokenPipe affect Steam on macOS, Linux, or the Steam Deck?
No. The vulnerability targets steamservice.exe, a Windows-specific component of the Steam client. Reporting on the flaw specifically identifies it as a Windows Client Service issue.
How is BrokenPipe different from the Valve shipping-partner data breach?
They are unrelated incidents. BrokenPipe is a software vulnerability in the Steam Windows client. The separate incident involved attackers compromising Valve’s shipping partner, CEVA Logistics, and stealing data belonging to Steam hardware customers in Europe. Both were reported in the same general period, but they involve different systems and different attackers.
Can antivirus or endpoint protection software block BrokenPipe exploitation?
Standard antivirus signatures may not reliably catch a novel exploit chain like this one, though behavior-based endpoint detection tools that flag unusual privilege-escalation activity offer a better layer of defense than signature matching alone until an official patch ships.
Where can I check for an official fix once one is released?
Valve typically publishes Steam client update notes through the Steam client itself and its official community and support channels. There was no confirmed patch timeline as of this writing.
Related Coverage
- BigDiskBuster Defender Zero-Day: 0 CVE, 0 Patch [2026]
- Talos Ships CAIRN Tool to Track 4-Model AI Malware [2026]
- CLOSEDQUORUM Malware Lets 4 AI Models Vote on Next Move [2026]
- AppOmni vs Obsidian vs CrowdStrike: 100-App SSPM Gap [2026]
- Game Server Security Setup: 13 Steps, 2 CVEs Fixed [2026]
