Atredis Partners details six Steam flaws, including zero-click RCE
Researchers including Bryan Alexander showed code execution requiring only a client authenticated to the same Steam account as the target.
Security firm Atredis Partners published research on October 28, 2026 describing six vulnerabilities in Steam on Windows, including two remote code execution issues and four local privilege escalation issues, according to gamespark.jp. The flaws were reported to Valve in advance through its HackerOne bug bounty program.
The remote code execution issues were found in communication between Steam clients logged into the same account, specifically in download schedule change messages and game install/update status messages. The researchers, including Bryan Alexander, demonstrated zero-click code execution that required only that the attacker control a client authenticated to the same Steam account as the target.
On the local privilege escalation side, one issue allowed a program to run with SYSTEM privileges by abusing how game install scripts are processed.
According to the published findings, the details released were either already fixed or had passed their disclosure deadline when they appeared.
Quick answers
What vulnerabilities did Atredis Partners find in Steam?
Two remote code execution issues and four local privilege escalation issues in Steam on Windows, according to the published research.
Were the Steam flaws fixed?
The published details were either fixed or past their disclosure deadline, according to the findings.
How were the Steam issues reported to Valve?
Through Valve's HackerOne bug bounty program.