Live › vulnerability › CVE-2026-96542
Go to dashboardThe standalone installer for EA Javelin Anticheat sets incorrect permissions on the EAAntiCheatService service, so a local non-admin user can change its configuration and executable path. That lets them run code as NT AUTHORITY\SYSTEM.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only Windows machines where the EA Javelin Anticheat standalone installer was run manually, per the sources. The sources say standard installations through the EA App and Steam are not affected, so teams that only use those paths can skip it. Shared Windows machines with multiple local non-admin users are the most exposed.
No product ranges from the sources yet.
1.0.14329371, 1.0.14547437, 1.0.14789537 and 1.0.14940698.1.0.14940699 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam. This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title.
This page as .md · .json · in your agent: get_signal("CVE-2026-96542")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.