CVE-2026-96542EA Javelin Anticheat Installer Local Privilege Escalation
Updated under an hour ago ()
Does this affect you?
It affects Electronic Arts EA Javelin Anticheat (EA Javelin Anticheat Installer). Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam. This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title.
- CVSS
- 5.0 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
- Weakness (CWE)
- CWE-732
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- EA
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 16, 2026
Affected products
Electronic Arts EA Javelin Anticheat (EA Javelin Anticheat Installer) electronic_arts:ea_javelin_anticheat_ea_javelin_anticheat_installer (from the name) | 1.0.14329371 (Specific affected standalone versions: 1.0.14329371, 1.0.14547437, 1.0.14789537, 1.0.14940698) | CNA record |
References
- https://catsandmalware.com/blog/eight-bytes-to-system/technical-description, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.