Working exploits released for zero-click Steam sync flaws
Atredis Partners found two buffer overflows in the messages Steam syncs between PCs signed in to the same account, allowing a zero-click takeover of the client on another machine. The firm released working exploits and says each bug is patched or past its disclosure deadline. Users should keep the Steam client updated.
What happened
Atredis Partners found two flaws in the Steam client that allowed taking over a computer from another PC signed in to the same account, with no user click. The firm published working exploits demonstrating the attack.
Why it matters
Anyone with access to one PC on a Steam account could compromise the client on another machine of that account, exposing sessions and account data. With public exploits now circulating, outdated clients remain at risk.
What to do
Update the Steam client on all company machines now and check for old installed versions. Instruct staff not to share corporate Steam accounts across multiple computers.
For the technical team
- Affected
- Steam (cliente) · Steam client (versions not specified in sources).
- Exploitation
- Working exploits published by Atredis Partners. No in-the-wild exploitation reported in the sources.
- Fix
- Atredis says each bug is patched or past its disclosure deadline; fixed versions not specified in the sources.
- Vector
- Steam client, message sync between PCs signed in to the same account. Two buffer overflows in the synced messages; zero-click exploitation from another PC on the same account.
- More details
- Discovery attributed to Atredis Partners. Flaws described as zero-click, with no victim interaction. Disclosed after the disclosure deadline, alongside working exploits.
Timeline
Atredis Partners discloses two buffer overflows in Steam sync and releases working exploits.
Sources 1 source
- @IntCyberDigest @IntCyberDigest
