Windows Zero-Day in Steam Client Service Grants SYSTEM Privileges A newly disclosed zero-day vulnerability in the Steam Client Service for Windows allows local attackers to escalate privileges to NT AUTHORITY\SYSTEM the highest level of access on a system without requiring administrator credentials, User Account Control (UAC) prompts, or Steam authentication. Security researcher KillaBoi released the BrokenPipe proof-of-concept (PoC) exploit on September 14, demonstrating how an unprivileged local user can abuse steamservice.exe, Steam’s privileged Windows service. The flaw stems from a signature-coverage gap in Steam’s installation workflow: while the service accepts a Valve-signed install-script (VDF), it fails to validate the caller-controlled installation root path, enabling attackers to redirect execution to malicious code. The exploit works by: 1. Establishing an inter-process communication (IPC) connection to the Steam Client Service. 2. Invoking IClientInstallUtils::AddInstallScriptToWhiteList with a legitimate VDF and an attacker-specified path, tricking the service into trusting a relocated launcher. 3. Triggering IClientInstallUtils::RunInstallScript, which executes the launcher with SYSTEM-level privileges. The PoC, written in PowerShell with embedded C#, demonstrates the attack by copying cmd.exe to a user-controlled location and executing it as SYSTEM, confirmed by whoami returning NT AUTHORITY\SYSTEM (SID S-1-5-18). The exploit was successfully tested against Steam version 10.96.30.42 on Windows 10 and 11 (64-bit). While BrokenPipe requires local access (e.g., via malware or another exploit), it poses a significant risk as a second-stage attack vector in multi-step compromises. The researcher reported the issue to Valve in March 2026, but the company marked the submission as a duplicate and has not issued a public advisory, CVE assignment, or patch. As of publication, the vulnerability remains a zero-day with no confirmed remediation. Organizations running Steam on shared or corporate systems face potential privilege-escalation exposure, though no active exploitation has been reported. Defenders are advised to monitor for unusual processes spawned by steamservice.exe and restrict executables running as SYSTEM from user-writable directories.

Ace & Tate Reports Data Breach Linked to Logistics Partner Eyewear retailer Ace & Tate has notified customers of a data breach stemming from a security incident at an unnamed logistics partner. The breach, reported to the Dutch Data Protection Authority, follows a pattern seen in recent disclosures from Bijenkorf, Bol, ING, and Ajax suggesting possible involvement of CEVA Logistics. While financial data, usernames, and passwords were not exposed, compromised information may include names, shipping and billing addresses, email addresses, phone numbers, order details, and track-and-trace data. The company has warned customers to remain cautious of potential phishing attempts. No further details on the timeline or scope of the breach have been disclosed.

Steam Hardware Customers in Europe Warned of Phishing Risks After CEVA Logistics Cyberattack Valve has alerted European customers who purchased Steam hardware such as the Steam Deck or Steam Machine of potential phishing attempts following a cyberattack on its logistics partner, CEVA Logistics. The breach, detected on August 7, 2026, occurred between July 29 and August 1, exposing customer data held by CEVA for order fulfillment. The compromised information includes names, addresses, phone numbers, email addresses, and details about ordered products (type and price). However, Valve confirmed that sensitive data such as payment details, passwords, and Steam Guard codes was not accessed, as CEVA does not store this information. Valve warns customers to expect fraudulent messages via email, SMS, or phone, impersonating Steam, Valve, or delivery services. Attackers may demand fake customs or delivery fees or direct victims to phishing portals. Valve advises verifying URLs (e.g., help.steampowered.com for support) and avoiding embedded links in suspicious messages. The company also reiterated that legitimate Steam communications will never request passwords or Steam Guard codes. CEVA has isolated the affected systems, notified data protection authorities, and engaged external investigators to assess the incident. The breach underscores the risks of third-party supply chain attacks, even when primary platforms remain secure.