CVE-2026-96542

MEDIUM 5.0

EA Javelin Anticheat Installer Local Privilege Escalation

CVSS Score

5.0

EPSS Score

0.0%

EPSS Percentile

0th

Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam. This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title.

CWE	CWE-732
Vendor	electronic arts
Product	ea javelin anticheat (ea javelin anticheat installer)
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for electronic arts ea javelin anticheat (ea javelin anticheat installer)

Be the first to know when new medium vulnerabilities affecting electronic arts ea javelin anticheat (ea javelin anticheat installer) are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

Electronic Arts / EA Javelin Anticheat (EA Javelin Anticheat Installer)

1.0.14329371 (Specific affected standalone versions: 1.0.14329371, 1.0.14547437, 1.0.14789537, 1.0.14940698)

References

NVD ↗ CVE.org ↗ EPSS Data ↗

catsandmalware.com: https://catsandmalware.com/blog/eight-bytes-to-system/

Credits

Miles Norris ([email protected])