Loading story…
A publicly disclosed zero-day in the Windows Steam Client Service (steamservice.exe), dubbed BrokenPipe, can let a standard local user execute attacker-controlled code as NT AUTHORITY\SYSTEM. The flaw reportedly exploits a signature-coverage gap in Steam’s installation-script workflow: the privileged service accepts a legitimate Valve-signed VDF file together with a caller-controlled installation-root path, enabling a malicious launcher placed at that location to run with SYSTEM privileges.
Researcher KillaBoi published a proof of concept reportedly effective against Steam version 10.96.30.42 on 64-bit Windows 10 and Windows 11, and stated Valve had been aware of the issue since March 2026. Exploitation requires prior local code execution and an installed, available Steam service, making it a post-compromise privilege-escalation vector rather than a remote entry point. No public Valve advisory, CVE, or confirmed remediation was available; organizations should review Steam installations and investigate SYSTEM-level child processes launched by steamservice.exe, particularly where executables originate from user-writable paths.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
KillaBoi published a proof of concept for BrokenPipe, which abuses a signature-coverage gap in Steam's installation-script workflow to have steamservice.exe execute an attacker-controlled launcher as NT AUTHORITY\SYSTEM. The reported PoC worked against Steam 10.96.30.42 on recent 64-bit Windows 10 and Windows 11 systems.
Researcher KillaBoi stated that Valve had known about the BrokenPipe local privilege-escalation issue affecting the Windows Steam Client Service since March 2026.
A related HackerOne submission concerning the BrokenPipe issue was reportedly marked as a duplicate.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-20817**, a local privilege escalation flaw in the Windows Error Reporting (**WER**) service that allows a low-privileged user to obtain **SYSTEM** privileges by sending a crafted **ALPC** message to `\WindowsErrorReportingServicePort`. The bug resides in `WerSvc.dll` and affects the `SvcElevatedLaunch` code path, where user-controlled data from a file-mapping-backed buffer can be passed as command-line arguments when the service launches `WerFault.exe` with `CreateProcessAsUserW` under SYSTEM context. Patch analysis showed Microsoft mitigated the issue by effectively disabling the vulnerable `SvcElevatedLaunch` feature rather than rewriting the logic, with the patched path returning `0x80004005` (`E_FAIL`). Researchers produced a proof of concept demonstrating SYSTEM-context `WerFault.exe` execution with attacker-controlled arguments, although full arbitrary code execution would require additional Windows internals techniques; they also noted operational constraints such as the WER service needing to be running and possible Microsoft Defender detection because the behavior resembles parent process ID spoofing. Reports further warned that fake and potentially malicious GitHub proof-of-concept repositories for **CVE-2026-20817** are already circulating.
Jun 29, 2026
A public proof-of-concept exploit dubbed **MiniPlasma** has been released for a Windows local privilege escalation flaw that can grant attackers **SYSTEM** access on fully patched machines. The exploit targets `cldflt.sys`, the Windows Cloud Files Mini Filter Driver used by cloud sync features such as OneDrive, and specifically abuses the `HsmOsBlockPlaceholderAccess` routine. Researchers said the bug appears tied to **`CVE-2020-17103`**, a vulnerability originally reported by Google Project Zero's James Forshaw in 2020 and believed to have been fixed by Microsoft, but the original exploit path reportedly still works. The exploit abuses missing access checks and a race condition during token switching to create arbitrary registry keys in the `.DEFAULT` user hive and ultimately spawn a SYSTEM shell. Researcher Chaotic Eclipse, also referenced as Nightmare-Eclipse, published the code on GitHub, while Will Dormann reported that it works reliably on Windows 11 systems with the May 2026 updates, though not on the latest Insider Preview Canary builds. Because the affected driver is broadly deployed across Windows environments, the release of reliable public exploit code sharply raises near-term risk while organizations await clarification or a fix from Microsoft.
Jul 1, 2026
A publicly disclosed zero-day dubbed **ShieldBreak** (`CVE-2026-69414`) allows a local attacker with limited privileges to escalate to **SYSTEM** on Windows systems where Microsoft Defender is enabled. Reporting says the flaw affects the **Microsoft Malware Protection Engine** and serves as a bypass of Microsoft’s earlier fix for **RoguePlanet** (`CVE-2026-50656`), indicating the prior remediation was incomplete. Microsoft has acknowledged the issue and said it is working on a patch, but no release date has been announced. Technical analysis shows the exploit chains **Cloud Files** abuse, **NT Object Manager** namespace manipulation, direct use of Defender functionality through `MpClient.dll`, a remediation timing race, and **Windows Error Reporting** task abuse to coerce Defender into writing an attacker-controlled DLL to `C:\Windows\System32\phoneinfo.dll`, which is then executed by `wermgr.exe` as SYSTEM. Researchers reproduced the proof of concept on fully patched **Windows 11 24H2** and **Windows Server 2025** systems with default Defender settings, with elevation reportedly occurring in roughly eight to twelve seconds; key detection opportunities include creation of `phoneinfo.dll` in `System32`, `MpClient.dll` loading by non-Defender processes, suspicious activity under `\BaseNamedObjects\Restricted\`, and `wermgr.exe` loading the planted DLL.
Aug 20, 2026