CVE-2020-15530

CVE-2020-15530 describes a local privilege escalation vulnerability affecting the Valve Steam Client installer (version 2.10.91.91). During installation, the Steam client creates directories with weak permissions within %PROGRAMFILES(X86)%\Steam or %COMMONPROGRAMFILES(X86)%\Steam. An attacker can exploit this critical time window, which can be extended using opportunistic locks, to gain NT AUTHORITY\SYSTEM privileges. This vulnerability is rated as High severity with a CVSS score of 7.8, indicating a local attack vector with low complexity that can lead to complete compromise of confidentiality, integrity, and availability. While the EPSS score is low, suggesting minimal current exploitation risk, the FAUCET Risk Score is 57/100. There is currently no evidence of active exploitation, nor is exploit code available in Metasploit, Nuclei, or ExploitDB. The vulnerability has garnered minimal community discussion or media coverage, suggesting it is not widely known or actively targeted.