Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
RCE on Steam Client via buffer overflow in Server InfoAnalysed#470520	Valid	Memory Corruption	–	2019-03-15	–	1,289
Panorama UI XSS leads to Remote Code Execution via Kick/Disconnect MessageAnalysed#631956	Valid	Command and Code Injection	–	2019-10-08	–	420
Malformed .BMP file in Counter-Strike 1.6 may cause shellcode injectionAnalysed#397545	Valid	Memory Corruption	–	2020-02-27	–	321
OOB reads in network message handlers leads to RCEAnalysed#807772	Valid	Memory Corruption	–	2021-05-04	$7,500	219
RCE on CS:GO client using unsanitized entity ID in EntityMsg messageAnalysed#584603	Valid	Memory Corruption	–	2021-05-27	$9,000	209
[Portal 2] Remote Code Execution via voice packetsAnalysed#733267	Valid	Memory Corruption	–	2021-05-10	$5,000	173
[Half-Life 1] Malformed map name leads to memory corruption and code executionAnalysed#402566	Valid	Memory Corruption	–	2020-09-22	$1,500	163
Malformed save files (.sav) allow to write files with arbitrary extensions and content in GoldSrc-based games.Analysed#458842	Valid	Other weaknesses	–	2020-02-24	$1,500	99

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.