Critical Steam Windows 0-Day CVE-2023-6807 Allows SYSTEM Privilege Escalation

Key Takeaways

• A critical zero-day vulnerability (CVE-2023-6807) has been disclosed in the Steam Client Service for Windows.
• The flaw allows an unprivileged local user to escalate to NT AUTHORITYSYSTEM privileges without requiring administrator credentials or Steam authentication.
• The vulnerability affects Steam version 10.96.30.42 on Windows 10 and 11, with no official patch or CVE assignment from Valve at the time of disclosure.
• The issue stems from a signature-coverage gap, not memory corruption or signature forging.

Unprivileged Users Can Achieve SYSTEM Privileges Via Steam Client Service

A newly revealed zero-day vulnerability in the Windows Steam Client Service could allow a standard local user to gain NT AUTHORITYSYSTEM privileges. This critical flaw, identified as CVE-2023-6807, does not require administrator credentials, a User Account Control prompt, Steam authentication, or even the launch of a game to exploit.

Researcher KillaBoi published a proof-of-concept (PoC) called “BrokenPipe” on September 14, detailing the local privilege escalation method through steamservice.exe, Steam’s privileged Windows service.

Technical Details of the BrokenPipe Exploit

The vulnerability is not the result of a memory-corruption bug or a forged digital signature. Instead, the technical analysis reveals that Steam’s service accepts a caller-controlled installation root in conjunction with a legitimate, Valve-signed install-script VDF file. Crucially, this user-supplied path is not protected by the digital signature.

This oversight enables an unprivileged process to manipulate where the trusted installation workflow locates a launcher executable. Consequently, a legitimate signed manifest can be weaponized to achieve privileged code execution.

The BrokenPipe exploit initiates by establishing an inter-process communication (IPC) connection with the Steam Client Service. It then invokes the IClientInstallUtils::AddInstallScriptToWhiteList function, providing an authentic VDF file and an attacker-specified installation root. This action causes a relocated launcher to be marked as trusted.

Following this, a subsequent call to IClientInstallUtils::RunInstallScript prompts the SYSTEM-level service process to interpret the VDF and execute the attacker-controlled launcher with its elevated privileges. The technique exploits a gap in signature coverage, meaning it neither modifies, forges, nor bypasses Valve’s original signature.

The PoC, a single PowerShell script, embeds the signed VDF as Base64 data and implements the service’s shared-memory IPC client using inline C#. By default, the script copies the Windows Command Prompt to a relocated launcher.exe path and instructs Steam’s service to execute it. In a demonstration, the whoami command returned “NT AUTHORITYSYSTEM,” and whoami /user reported “S-1-5-18,” which is the well-known Security Identifier (SID) for Microsoft’s LocalSystem account.

Affected Systems and Impact

Testing confirmed the exploit’s success against Steam version 10.96.30.42 on recent 64-bit builds of Windows 10 and Windows 11. For the exploit to be successful, Steam must be installed, its service must be running, and the attacker must already possess the ability to execute code as a standard local user.

Therefore, BrokenPipe itself is not a remote compromise vector. However, it represents a potent second-stage capability, which could be leveraged following initial access gained through phishing, malware execution, or the exploitation of another vulnerability.

The researcher indicated that Valve has been aware of this issue since March 2026. Based on reports that the related HackerOne submission was marked as a duplicate, and Valve has reportedly not responded to requests for comment. As of publication, there has been no public advisory from Valve, no CVE assignment, and no confirmed security update addressing BrokenPipe, confirming its zero-day status due to the lack of a vendor fix.

What You Should Do

• Inventory Steam Installations: Identify all Windows systems within your environment that have the Steam client installed.
• Remove Unnecessary Clients: Uninstall the Steam client from corporate or shared systems where it is not essential for business operations.
• Monitor for Anomalous Processes: Implement monitoring to detect unusual child processes spawned by steamservice.exe.
• Alert on SYSTEM Executables from User Directories: Configure alerts for executables running with SYSTEM privileges from user-writable directories, as this is a common indicator of privilege escalation.
• Stay Updated, But Be Cautious: While keeping Steam updated is generally good practice, do not assume a general update mitigates BrokenPipe until Valve officially confirms a specific remediation for CVE-2023-6807.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.