-
Security researchers at Atredis Partners found six flaws in Valve’s Steam platform. Two let attackers run code remotely, and four raise user privileges.
-
One remote flaw could let an attacker run code on another connected Steam client. The victim does not need to do anything.
-
The researchers say they reported the issues to Valve through HackerOne. They also say the flaws were patched or passed their disclosure deadline.
Security researchers have found six weaknesses in Steam, one of the most popular PC gaming services in the world. The platform belongs to Valve.
The weaknesses raise fresh worries about how safe the service is for its many users. One of them could let an attacker run harmful code on a computer without any action from its owner.
Researchers Find Six Flaws in Steam’s Windows Client
Atredis Partners researcher Bryan Alexander shared the findings in a technical report on October 28, 2026. The report is titled “Turning the Valve.” It covers two remote code execution (RCE) flaws. These let an attacker run code on another device. It also covers four local privilege escalation (LPE) flaws. These let a person gain more power on a computer. All six affect Steam’s Windows client and the parts that support it.
Steam users have also faced threats from malicious game downloads. The FBI previously warned about a malware campaign targeting gamers through fake game files.
The most serious finding involves how Steam shares information between devices. According to the researchers, Steam lets people sign in to one account on several computers. Valve’s Connection Manager system then keeps those computers in sync. Some messages in this system are not handled safely.
The problem lies in how Steam processes them. A hacked client signed in to the same account could send specially made data to another connected computer. The researchers say this weakness sits in the way Steam handles those messages.
One flaw could let the attacker run harmful code on the receiving computer. The owner would not need to click a link. The owner would not need to open a file or approve anything. This makes it a zero-click flaw, since the victim takes no action at all.
The second RCE flaw involves messages about game installs and updates. The team also found a weakness that leaks memory addresses. The researchers used it to turn one flaw into a working zero-click attack.
The four LPE flaws pose a different risk. They need local access, so they work differently from the remote flaws. They involve Steam’s privileged Windows service. They also involve the parts that handle install scripts, module loading, secure desktop capture, and driver installation. Someone who already has local access to a Windows computer could gain higher system rights.
Valve Receives the Reports Through HackerOne
Atredis says it sent every finding to Valve through its HackerOne security program. The team also released proof-of-concept material. Part of the work was presented at BSides PDX 2026. Atredis stated that the flaws were either patched or past its disclosure deadline. However, reports say the fixed status of each flaw remains unclear.
The research shows no sign that attackers used these flaws against real Steam users. The findings come from weaknesses that the researchers found and tested themselves. They do not confirm a widespread attack. Valve also lists security details on its security page.
Steam is mainly known as a gaming and digital distribution platform. Yet it does more than sell games. The client also handles messaging, account syncing, and remote connections. It runs other background tasks as well. Weak spots in these parts can give attackers a way in beyond the games themselves. The findings highlight the risks that can exist in any software that communicates across many devices.
Steam users should install the latest client version. They should also review which devices can access their accounts. Steam Guard can add extra protection to an account. Users should remove any unfamiliar device that stays connected.
Gamers on X React to the Disclosure
The findings also drew reactions from users on X. Many of them focused on how Valve reportedly handled the reports. Larry (@LaireLaFlare) liked the order of events. He wrote that the flaws were reported and patched before the public heard about them. He called that the right order for once.
Gary Hyde (@SoltheHedgehog) said Steam’s good name and its bond with customers pushed researchers to report privately. He argued that people wanted to protect the service. They also wanted to give Valve time to fix the problems.
Alderwolf (@Alderwolf99) praised the reported response too. He felt surprised that Valve acted on the reports instead of brushing off the researchers. His comment reflected a wider frustration with companies that fail to answer vulnerability reports properly.
Other users chose humor. Uncle Joe (@Uncle_Joe_Gamer) joked that Steam has six security holes. He said his game backlog is still the scariest thing on the platform. Lightsyde (@Lightsyde) also joined in with a joke involving Epic Games CEO Tim Sweeney and Valve boss Gabe Newell.
The reactions varied, but most of the talk centered on responsible disclosure. The discussion stressed why companies should work with security researchers. It also stressed fixing problems before anyone publishes technical details.
