Skip to main content

Steam Client CVE-2019-15316

HIGH
Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
2019-08-21 cve@mitre.org
Privilege Escalation Microsoft Steam Client
7.0
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Aug 21, 2019 - 20:15 nvd
HIGH 7.0

DescriptionNVD

Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition.

AnalysisAI

Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to. Rated high severity (CVSS 7.0). Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-367. Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition. Affected products include: Valvesoftware Steam Client. Version information: through 2019.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Steam Client

View all
CVE-2021-30481 CRITICAL POC
9.0 Apr 10

Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbi
CVE-2020-15530 HIGH POC
7.8 Jul 05

An issue was discovered in Valve Steam Client 2.10.91.91. Rated high severity (CVSS 7.8), this vulnerability is low atta
CVE-2019-17180 HIGH POC
7.8 Oct 04

Valve Steam Client before 2019-09-12 allows placing or appending partially controlled filesystem content, as demonstrate
CVE-2015-7985 HIGH POC
7.2 Nov 24

Valve Steam 2.10.91.91 uses weak permissions (Users: read and write) for the Install folder, which allows local users to
CVE-2019-14743 MEDIUM POC
6.6 Aug 07

In Valve Steam Client for Windows through 2019-08-07, HKLM\SOFTWARE\Wow6432Node\Valve\Steam has explicit "Full control"

CVE-2019-15315 HIGH
7.8 Aug 21

Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local use
CVE-2015-4016 MEDIUM
5.0 May 20

The client detection protocol in Valve Steam allows remote attackers to cause a denial of service (process crash) via a

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH POC
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2022-48618 HIGH
7.0
CVE-2023-38146 HIGH POC
8.8
CVE-2025-34027 CRITICAL POC
10.0
CVE-2020-1337 HIGH POC
7.8
CVE-2026-25641 CRITICAL POC
10.0
CVE-2024-28718 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0

Share

CVE-2019-15316 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy