CVE-2019-15316

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition.

Metrics

CVSS 3.0 7.0/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367 CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://amonitoring.ru/article/onemore_steam_eop_0day/Third Party Advisory
https://habr.com/ru/company/pm/blog/464367/Third Party Advisory
https://www.youtube.com/watch?v=I93aH86BUaEExploit, Third Party Advisory
https://www.youtube.com/watch?v=ZCHrjP0cMewExploit, Third Party Advisory
https://amonitoring.ru/article/onemore_steam_eop_0day/Third Party Advisory
https://habr.com/ru/company/pm/blog/464367/Third Party Advisory
https://www.youtube.com/watch?v=I93aH86BUaEExploit, Third Party Advisory
https://www.youtube.com/watch?v=ZCHrjP0cMewExploit, Third Party Advisory

Timeline

Published: Aug 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-153175.4The give plugin before 2.4.7 for WordPress has XSS via a donor name.CVE-2019-153189.8The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.CVE-2019-153199.8The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.CVE-2019-153209.8The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.CVE-2019-153219.8The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.CVE-2019-153229.8The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.CVE-2019-153237.5The ad-inserter plugin before 2.4.20 for WordPress has path traversal.CVE-2019-153248.8The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.CVE-2019-153257.5In GalliumOS 3.0, CONFIG_SECURITY_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptrace_scope to 1, wh CVE-2019-153267.5The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.CVE-2019-153276.1The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.CVE-2019-153286.1The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.