CVE-2021-30481

HIGH

Valve Steam <2021-04-17 - RCE

Title source: llm
STIX 2.1

Description

Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click.

Exploits (1)

nomisec WORKING POC 58 stars
by floesen · poc
https://github.com/floesen/CVE-2021-30481

References (4)

Core 4
Core References
Issue Tracking, Third Party Advisory
https://news.ycombinator.com/item?id=26762170
Exploit, Third Party Advisory
https://www.youtube.com/watch?v=rNQn--9xR1Q

Scores

CVSS v3 8.0
EPSS 0.0750
EPSS Percentile 91.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Details

CWE
CWE-120
Status published
Products (1)
valvesoftware/steam_client < 2021-04-10
Published Apr 10, 2021
Tracked Since Feb 18, 2026