CVE-2021-30481: Valvesoftware Steam Client

Critical severity, CVSS 9.0. EPSS: 3.5% chance of exploitation in the next 30 days.

Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click.

Affected products

• Valvesoftware Steam Client: up to and including 2021-04-10

Published 2021-04-10. Last modified 2026-06-17.