CVE-2019-17180

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-10-04 · updated 2026-06-17
Weakness: CWE-22

Description

Valve Steam Client before 2019-09-12 allows placing or appending partially controlled filesystem content, as demonstrated by file modifications on Windows in the context of NT AUTHORITY\SYSTEM. This could lead to denial of service, elevation of privilege, or unspecified other impact.

Affected products

Valvesoftware Steam Client: before 2019-09-12 — fixed in 2019-09-12

How to fix

Upgrade to a fixed version: Valvesoftware Steam Client 2019-09-12. Check the vendor advisory for mitigations.

References

https://amonitoring.ru/article/steam_vuln_3/
https://habr.com/ru/company/pm/blog/469507/
https://hackerone.com/reports/583184
https://hackerone.com/reports/682774
https://store.steampowered.com/news/54236/
https://amonitoring.ru/article/steam_vuln_3/
https://habr.com/ru/company/pm/blog/469507/
https://hackerone.com/reports/583184
https://hackerone.com/reports/682774
https://store.steampowered.com/news/54236/

Get alerted when CVE-2019-17180 or the next vulnerability affects your stack