Researchers Disclose 6 Steam Vulnerabilities, Including 2 RCE Flaws
Atredis Partners said the two remote code execution flaws could be triggered with zero clicks when an attacker controls a client logged into the same Steam account.
Security researchers at Atredis Partners published a report on October 28, 2026 detailing 6 vulnerabilities in Steam, including 2 remote code execution flaws and 4 local privilege escalation flaws, according to gamebusiness.jp. All the issues were reported to Valve through its HackerOne program, and the disclosed items were either fixed or past their disclosure deadline.
The two remote code execution flaws sit in Steam client communication handling between clients logged into the same account, specifically in messages about download schedule changes and game install or update status. The researchers, including security researcher Bryan Alexander and colleagues, demonstrated zero-click code execution under the condition that an attacker can operate a client authenticated to the same Steam account as the target.
On the local privilege escalation side, one issue involved a game installation script that could run a program with SYSTEM privileges.
Atredis Partners is a security research and consulting firm. Valve operates Steam.
Quick answers
How many Steam vulnerabilities did Atredis Partners disclose?
The firm disclosed 6: 2 remote code execution flaws and 4 local privilege escalation flaws.
Were the Steam vulnerabilities fixed?
All were reported to Valve via HackerOne, and the disclosed items were either fixed or past their disclosure deadline.
What condition is needed for the zero-click code execution?
The attacker must be able to operate a client authenticated to the same Steam account as the target.