What’s Vulnerable › Vulnerabilities

CVE-2019-15316

• Severity: high (CVSS 7.0 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-08-21 · updated 2026-06-17
• Weakness: CWE-367

Description

Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition.

Affected products

• Valvesoftware Steam Client: through 2019-08-20

References

• https://amonitoring.ru/article/onemore_steam_eop_0day/
• https://habr.com/ru/company/pm/blog/464367/
• https://www.youtube.com/watch?v=I93aH86BUaE
• https://www.youtube.com/watch?v=ZCHrjP0cMew
• https://amonitoring.ru/article/onemore_steam_eop_0day/
• https://habr.com/ru/company/pm/blog/464367/
• https://www.youtube.com/watch?v=I93aH86BUaE
• https://www.youtube.com/watch?v=ZCHrjP0cMew

Get alerted when CVE-2019-15316 or the next vulnerability affects your stack