Valve’s Steam platform was found to be susceptible to zero-click remote code execution between computers signed into the same account, based on information published by Cyber Insider.
Atredis Partners researcher Bryan Alexander detailed these findings on Oct. 28, 2026, following a presentation at BSides PDX. The research identified that Steam’s synchronization messages, exchanged through the Connection Manager infrastructure, allow remote attacks without requiring Remote Play pairing. An attacker controlling a Steam client authenticated to the same account could exploit two stack buffer overflows to execute code on a target machine. These overflows occur during download-schedule notifications and application-status updates. Additionally, an information leak in download-schedule messages exposed memory addresses, facilitating the development of a zero-click exploit. Beyond remote threats, researchers discovered four methods to escalate privileges locally by abusing the Steam service, which operates with Windows SYSTEM permissions. These flaws involve installation scripts, legacy module loading, secure desktop capture components and driver installation processes. While Atredis reported these issues through Valve’s HackerOne program, the current patch status for each vulnerability remains unclear. Users are advised to keep the Steam client updated and monitor authenticated devices for unauthorized access, as the full extent of the remediation remains unconfirmed.
Source: Cyber Insider
