Google's Project Zero should look into this. It is not the first time that Valve slept on known and reported vulnerabilities.