CVE-2026-96542

Received Received - Intake

Incorrect Permission Assignment in EA Javelin Anticheat Standalone Installer

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Electronic Arts, Inc.

Description

Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam. This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-96542

Affected Vendors & Products

Vendor	Product	Version / Range
Electronic	Arts	EA Javelin Anticheat (EA Javelin Anticheat Installer) 1.0.14329371 (Specific affected standalone versions: 1.0.14329371, 1.0.14547437, 1.0.14789537, 1.0.14940698)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability involves incorrect permission assignment in the EA Javelin Anticheat standalone installer for Windows. A local non-administrative user can exploit it to elevate privileges to SYSTEM by modifying the EAAntiCheatService service configuration and executable path. The issue requires manual execution of the standalone installer and does not affect standard game installations via EA App or Steam.

Detection Guidance

Check for the presence of EA Javelin Anticheat versions 1.0.14329371, 1.0.14547437, 1.0.14789537, or 1.0.14940698 by inspecting installed programs or service configurations. Look for the EAAntiCheatService running with non-standard permissions.

Impact Analysis

An attacker could gain full system control (SYSTEM privileges) on a vulnerable machine, allowing them to install malicious software, access sensitive data, or disrupt system operations. This requires local access and manual execution of the standalone installer.

Compliance Impact

This vulnerability involves incorrect permission assignment allowing privilege escalation to SYSTEM level. It does not directly impact GDPR or HIPAA compliance as it requires non-standard manual execution of the installer and does not affect standard game installations.

Mitigation Strategies

Update EA Javelin Anticheat to version 1.0.14940699 or later. If updating is not possible, restrict write permissions to the service executable path and configuration files. Ensure the service runs with default permissions.

Hi! I’m here to help you understand CVE-2026-96542. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70