{"rewrite":{"id":"r_52057d053ded5bfbc55566dd","clusterId":"c_3a531942b94ebfc732cbb489","slug":"atredis-partners-finds-six-steam-vulnerabilities-reports-all-to-valve","model":"deepseek-v4-1-flash","headline":"Atredis Partners Finds Six Steam Vulnerabilities, Reports All to Valve","summary":"Atredis Partners published findings on October 28 from its investigation into Steam's inter-device communication processing. Researchers led by Bryan Alexander reported two remote code execution issues and four local privilege escalation issues, confirmed in a Windows environment with proof-of-concept results. Alexander said all were reported through Valve's HackerOne program, and the published material is either already fixed or past its disclosure deadline.","whyItMatters":"The demonstrated remote code execution needs a client already logged in to the same Steam account, so the immediate third-party attack risk is low, but the report shows Steam's inter-client messaging as an attack surface that researchers can chain into zero-click execution.","webCardHtml":"\u003cp\u003eThe remote code execution flaws sit in message handling between Steam clients signed in with the same account. Atredis names two cases: messages that notify of download schedule changes and messages that notify of game install or update status. Combining one of those with a separate information leakage bug produced zero-click execution, with no click or file open needed on the target machine.\u003c/p\u003e\u003cp\u003eThe four local privilege escalation findings include a path to SYSTEM privileges through the processing of a game installation script. Alexander said the flaws went to Valve through HackerOne, and that what is published is fixed or past the disclosure deadline.\u003c/p\u003e","blueskyPost":"Atredis Partners published its Steam security findings on Oct 28: two remote code execution issues and four local privilege escalation issues, confirmed on Windows. Bryan Alexander says all went to Valve via HackerOne; published items are fixed or past the disclosure deadline.","twitterPost":"Atredis Partners published Steam vulnerability findings on Oct 28: two RCE issues in inter-client messaging and four local privilege escalation issues, confirmed on Windows. Bryan Alexander says all were reported to Valve via HackerOne; published items are fixed or past deadline.","threadsPost":null,"newsletterBlurb":"Atredis Partners published findings from its Steam security investigation on October 28, listing two remote code execution issues and four local privilege escalation issues confirmed in a Windows environment. The RCE demonstration chained a messaging flaw with an information leak to achieve zero-click execution, which requires an attacker already logged in to the same Steam account. Bryan Alexander said all issues went to Valve through its HackerOne program, and the published material is fixed or past the disclosure deadline.","attributionJson":"[{\"source\":\"Game Spark\",\"url\":\"http://www.gamespark.jp/article/2026/10/30/174312.html\",\"title\":\"Security Researchers Find Six Vulnerabilities in Steam Including \\\"Remote Code Execution\\\"; Reported to Valve - Findings Demonstrating \\\"Zero-Click\\\" Code Execution Published\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":5192,"outputTokens":714,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1793359762,"createdAt":"2026-10-30T11:24:02.000Z","publishedAt":"2026-10-30T11:28:09.000Z","updatedAt":"2026-10-30T11:28:09.000Z"},"cluster":{"id":"c_3a531942b94ebfc732cbb489","canonicalTitle":"Steamで「リモートコード実行」など6件の脆弱性をセキュリティ研究者が発見。Valveへ報告済み―「ゼロクリック」のコード実行などを実証した調査結果が公開","representativeArticleId":"a_ac8723bee00e38baee03c347","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[],\"studios\":[\"Valve\"],\"people\":[],\"type\":\"news\",\"domain\":\"games\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-10-30T10:45:03.000Z","lastSeenAt":"2026-10-30T10:45:03.000Z","updatedAt":"2026-10-30T11:28:09.000Z"},"attribution":[{"source":"Game Spark","url":"http://www.gamespark.jp/article/2026/10/30/174312.html","title":"Steamで「リモートコード実行」など6件の脆弱性をセキュリティ研究者が発見。Valveへ報告済み―「ゼロクリック」のコード実行などを実証した調査結果が公開"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":[],"studios":["Valve"],"people":[],"type":"news","domain":"games","is_roundup":false},"keyFacts":["Atredis Partners published its Steam vulnerability findings on October 28.","Bryan Alexander and colleagues reported two remote code execution issues and four local privilege escalation issues, confirmed in a Windows environment.","The remote code execution flaws were found in communication processing between Steam clients logged in with the same account.","The researchers demonstrated zero-click code execution by combining a flaw with a separate information leakage bug.","Alexander said all issues were reported through Valve's HackerOne program, and published content is fixed or past the disclosure deadline."],"pageLinks":{"healthSlugs":["valve"],"storySlugs":[],"entities":[{"slug":"valve","supported":2,"disputed":0,"contradicted":0,"unverified":30,"overall":"green","story_count":41,"has_dossier":true}],"stories":[],"entitiesOk":true,"storiesOk":true}}