A critical zero-day vulnerability has been discovered in the Steam Client Service for Windows, enabling local standard users to escalate their privileges to NT AUTHORITY SYSTEM without needing administrator credentials or triggering security prompts. This vulnerability, known as BrokenPipe, was made public by researcher KillaBoi on September 14. It exploits a flaw in the steamservice.exe, a privileged Windows service of Steam, allowing an unprivileged process to manipulate the installation path used by the service.

The issue lies in the service's handling of the installation root and a Valve-signed install-script VDF. The installation path is not protected by the signature, enabling attackers to influence where the trusted installation workflow retrieves a launcher. This vulnerability does not involve memory corruption or signature forgery but instead takes advantage of a gap in the signature coverage.

The proof of concept, a PowerShell script, demonstrates how an attacker can copy the Windows Command Prompt to a new location and execute it with SYSTEM privileges via the Steam service. Successful exploitation has been confirmed on Steam version 10.96.30.42 running on recent 64-bit Windows 10 and 11 systems. However, the attacker must already have the ability to execute code as a standard user.

Despite the vulnerability's potential severity, Valve has not yet released a public advisory or security update. BrokenPipe remains a zero-day threat as no confirmed fix has been issued. Organizations using Steam on shared or corporate Windows systems should be vigilant about this potential privilege-escalation risk. Until Valve provides a remedy, security teams are advised to inventory Steam installations, remove unnecessary clients, and monitor for unusual activity related to steamservice.exe.