PT-2025-22384 · Valve · Steam Client

Published 2025-05-21 · Updated 2025-12-27 · CVE-2025-27998

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Valvesoftware Steam Client version 1738026274

Description The issue allows attackers to escalate privileges via a crafted executable or DLL. This can be achieved by manipulating a specifically crafted executable or DLL, which enables the attackers to gain elevated access.

Recommendations For version 1738026274, consider restricting the execution of external executables or DLLs to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using potentially vulnerable executables or DLLs with the Steam Client.

Fix

LPE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-27998

Affected Products

Steam Client

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-27998 · Security Note
• https://t.me/cvetracker/24380 · Telegram Post
• https://gist.github.com/sornram9254/e8d10efcf246cc50ff3d4f837b261616 · Note
• https://twitter.com/CVEnew/status/2005031817020109283 · Twitter Post