CVE-2019-17180

7.8 highEPSS 0.7%

High (7.8) in valvesoftware steam client. EPSS 0.7% chance of exploitation in the next 30 days.

Valve Steam Client before 2019-09-12 allows placing or appending partially controlled filesystem content, as demonstrated by file modifications on Windows in the context of NT AUTHORITY\SYSTEM. This could lead to denial of service, elevation of privilege, or unspecified other impact.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2019-10-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

valvesoftware:steam_client

References

https://amonitoring.ru/article/steam_vuln_3/
https://habr.com/ru/company/pm/blog/469507/
https://hackerone.com/reports/583184
https://hackerone.com/reports/682774
https://store.steampowered.com/news/54236/

Check your stack JSON