Steam BrokenPipe: Local Privilege Escalation Flaw

A newly publicised local privilege escalation bug, called BrokenPipe, in Steam’s Client Service (steamservice.exe) on Windows 10 and 11 allows any standard user to escalate into NT AUTHORITY\SYSTEM without requiring an administrative password or triggering a User Account Control (UAC) prompt. 

Researcher “KillaBoi” (KillaBoi/BrokenPipe on GitHub) reported it to Valve through HackerOne in March 2026. HackerOne closed it as a duplicate, no fix shipped, and on September 15, 2026, the researcher published a working PoC on GitHub. As of September 18, 2026, there’s still no patch. 

How It Works 

Preconditions 

• A standard, unprivileged interactive logon. 

• No UAC prompt, since it’s the service, already SYSTEM, doing the work, not an elevation request from the caller. 

• Steam doesn’t need to be logged in, and no game needs to exist on the machine. The service just needs to be running, which is the default from boot onward. 

• Confirmed against Steam client 10.96.30.42 on Windows 10 and 11 x64. 

The Privilege Split 

Steam splits itself into a user-mode client (runs as the logged-in user) and steamservice.exe (runs as SYSTEM). The service exists to do things the client can’t, mainly running install scripts. 

Install scripts are .vdf files describing post-install steps for a game: run a redistributable, register a driver, launch a bundled setup exe. Since these can execute arbitrary code as SYSTEM, Valve signs them, and the service is only supposed to run scripts that carry a valid signature. 

The Bug 

BrokenPipe doesn’t forge a signature or touch a signed script’s contents. It exploits the fact that the signature covers the script’s content, not the installation root path the service ends up trusting once that script is whitelisted. 

The chain, through IClientInstallUtils: 

1. AddInstallScriptToWhiteList: caller hands over a real, validly-signed Valve script, but pairs it with an attacker-controlled install directory. The check only validates the script, so it accepts the pairing and whitelists the attacker’s path. 

1. RunInstallScript: the service runs the binary the script references, but from the attacker’s path, as SYSTEM. 

1. GetInstallScriptExitCode: caller checks the result. 

The service’s real trust boundary is “did Valve sign this script,” while the decision that actually matters, which directory to execute code from, is left entirely to the caller. 

Impact 

The public PoC hands over an interactive SYSTEM cmd.exe, with no persistence left behind. From there it’s the usual playbook: dump LSASS, install persistence, kill security tooling, pivot into the domain if the box is joined to one. The primitive itself is a complete, no-click local privilege escalation. 

Why It Matters 

Steam runs on a huge number of Windows machines, and its client service is one of those quietly-running SYSTEM processes nobody thinks about. A few things about steamservice.exe make it worth attention: 

• It installs and starts with Windows automatically. 

• It runs as SYSTEM because it needs to install drivers and redistributables (DirectX, VC++, etc.) on behalf of games. 

• It talks to any locally authenticated process over IPC, by design: the unprivileged Steam client has to ask it to do privileged work somehow. 

A SYSTEM service that takes instructions from an unprivileged caller is only as safe as the validation on those instructions. BrokenPipe is what happens when that validation has a hole in it, and it’s not limited to gaming rigs. Student labs, shared workstations, internet cafes, VDI/RDS gold images, even a dev laptop where someone installed Steam for lunch-break gaming, all become a SYSTEM escalation path. 

Detection and Mitigation 

Detection 

• Watch for steamservice.exe spawning odd children, like cmd.exe, powershell.exe, or anything running from a non-standard Steam path. Sysmon Event ID 1 filtered on parent image steamservice.exe is a reasonable start. 

• Alert on new SYSTEM processes whose parent chain traces back to Steam on hosts where that shouldn’t happen. 

• Flag .vdf install-script activity coming from outside standard Steam library paths. 

Mitigation 

• On shared or sensitive machines (kiosks, labs, VDI/RDS images, corporate laptops), pull Steam entirely, or at least set the Steam Client Service to Disabled instead of Automatic until a fix exists. 

• Where Steam has to stay, limit interactive logon on those hosts to trusted users; this still requires local interactive access. 

• Application control (WDAC/AppLocker) can blunt this whole class of “signed script, unsigned destination” abuse, not just this specific bug. 

• Watch Valve’s release notes and re-test with the PoC in an isolated, authorised environment once a fix lands. 

Takeaway for anyone building privileged IPC services: signing the payload isn’t the same as validating the environment it runs in. If a caller can influence a path that later gets used for privileged execution, that path is attacker-controlled no matter what else in the request checks out cryptographically. 

If you want to understand whether vulnerabilities like BrokenPipe could expose your Windows environment, our penetration testing services can identify exploitable weaknesses and demonstrate what an attacker could achieve. Our security risk assessment can also help identify and prioritise security risks across your environment.