Steam Bugs Let One Hijacked PC Run Code on Every Other Computer Signed Into the Same Account, No Clicks Needed

Steam lets one account stay signed in on several computers at once. Researchers have now shown how that convenience could become an attack path: control one logged-in Steam client, and you could run code on the others signed into the same account, with nobody on the receiving machine clicking anything.

Bryan Alexander of Atredis Partners detailed the work in an October 28 report, following a partial talk at BSides PDX 2026. The team also found four ways to jump to Windows SYSTEM privileges through Steam's own service, and it released proof-of-concept code.

Everything went through Valve's HackerOne program. Atredis says the issues are either patched or past its disclosure deadline, but the report does not give the fix status of each bug or a full list of patched versions.

The account is the bridge

The attack depends on a routine feature. Steam keeps sessions alive on multiple computers under one account, and those clients exchange synchronization messages through Valve's Connection Manager infrastructure. No Remote Play pairing is required.

An attacker does need a foothold first, in the form of control over a Steam client logged into the target's account. After that, the exploit needs no further interaction on the receiving PC.

Two stack buffer overflows did the damage. Download-schedule notifications copied an attacker-controlled list of app IDs into a fixed-size stack buffer without checking its length. Application-status updates copied progress records into an array with room for seven entries, so any extras overwrote the stack memory next to it.

A separate information leak made those flaws practical. Outgoing download-schedule messages sent a fixed number of entries even when fewer existed, which exposed uninitialized stack data containing memory addresses. That helped the researchers locate Steam's client library in memory and build a working exploit. Their demo ran from a Windows 10 virtual machine against an up-to-date Windows 11 target.

Four routes to SYSTEM

The privilege escalation bugs all run through the same component. Steam's service operates as Windows SYSTEM so it can install game dependencies, which makes it a tempting target for anyone already on the machine.

The first route abused installation scripts and an executable allowlist to run a substituted program as SYSTEM. The second used a legacy module-loading mechanism that could launch an attacker-controlled executable from a user-writable location.

The third is the strangest. Steam has a secure desktop capture component, used for elevation prompts during streaming. Once its input feature was authorized, local processes could inject keyboard and mouse events into the secure desktop, and in the researchers' tests they could approve elevation prompts automatically.

The fourth involved the driver install for the Steam Frame dongle. Validation was weak enough to allow unintended signed drivers, opening the door to bring-your-own-vulnerable-driver attacks.

Nobody will say what is fixed

The open question is which Steam version closes which hole. CyberInsider could not confirm that the latest client fixes everything, and Valve did not respond to its requests.

That leaves Steam users with the basic precautions: keep the client updated and review account access, especially any unfamiliar authenticated devices. The second one matters here because the whole chain starts with another client on the same account, and gaming logins already draw attackers. A recent Capcom ID breach hit 11.7 million accounts, with hackers changing passwords to lock the owners out.

Some offers on this page may be paid placements or contain affiliate links.