{"id":"CVE-2026-96542","kind":"vulnerability","aliases":["CVE-2026-96542"],"related":[],"title":"EA Javelin Anticheat installer lets local users gain SYSTEM privileges on Windows","description":"Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam. This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title.","summary":"The standalone installer for EA Javelin Anticheat sets incorrect permissions on the EAAntiCheatService service, so a local non-admin user can change its configuration and executable path. That lets them run code as NT AUTHORITY\\SYSTEM.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ea-javelin-anticheat","other","windows"],"not_affected_if":["default-config","standard-install-via-ea-app-or-steam"],"how_to_check":"- Check the installed Javelin version on the Windows machine against `1.0.14329371`, `1.0.14547437`, `1.0.14789537` and `1.0.14940698`.\n- Check whether the standalone installer was run manually; the sources say standard EA App and Steam installs are not affected.","fix":"- Update EA Javelin Anticheat to `1.0.14940699` or later.\n- Launching an integrated EA game title self-heals the service permissions, per the sources.","status":"open","published_at":"2026-10-16T21:21:02+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:31:00+00:00","updated_at":"2026-10-25T04:31:00+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T04:31:00Z","model":"claude-haiku-5-5","output":{"fix":"- Update EA Javelin Anticheat to `1.0.14940699` or later.\n- Launching an integrated EA game title self-heals the service permissions, per the sources.","reach":"local","title":"EA Javelin Anticheat installer lets local users gain SYSTEM privileges on Windows","impact":"high","summary":"The standalone installer for EA Javelin Anticheat sets incorrect permissions on the EAAntiCheatService service, so a local non-admin user can change its configuration and executable path. That lets them run code as NT AUTHORITY\\SYSTEM.","category":"other","nicknames":[],"who_cares":["windows","ea-javelin-anticheat"],"confidence":0.7,"needs_auth":"yes","worst_case":"Local non-admin user runs code as SYSTEM on Windows.","analyst_note":"","how_to_check":"- Check the installed Javelin version on the Windows machine against `1.0.14329371`, `1.0.14547437`, `1.0.14789537` and `1.0.14940698`.\n- Check whether the standalone installer was run manually; the sources say standard EA App and Steam installs are not affected.","needs_analyst":false,"not_affected_if":["default-config","standard-install-via-ea-app-or-steam"],"who_is_affected":"Only Windows machines where the EA Javelin Anticheat standalone installer was run manually, per the sources. The sources say standard installations through the EA App and Steam are not affected, so teams that only use those paths can skip it. Shared Windows machines with multiple local non-admin users are the most exposed.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000635,"input_tokens":3445,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-732':66C '-96542':15A,18A '1.0.14329371':76C '1.0.14547437':77C '1.0.14789537':78C '1.0.14940698':80C '1.0.14940699':137C 'admin':44B 'administr':88C 'affect':121C 'allow':83C 'anticheat':3A,22B,31B,74C 'app':128C 'assign':64C 'author':60B,95C 'automat':142C 'chang':47B 'code':57B 'configur':49B,102C 'correct':134C 'cve':13A,16A 'cwe':65C 'ea':1A,20B,29B,72C,127C,150C 'ea-javelin-anticheat':19B 'eaanticheatservic':37B,100C 'elev':91C 'execut':51B,104C,113C 'gain':8A 'game':123C,151C 'heal':145C 'incorrect':33B,62C 'instal':4A,27B,70C,117C,124C 'integr':149C 'issu':132C 'javelin':2A,21B,30B,73C 'later':139C 'launch':147C 'let':5A,54B 'local':6A,41B,85C 'manual':112C 'modifi':98C 'non':43B,87C,110C 'non-admin':42B 'non-administr':86C 'non-standard':109C 'nt':59B,94C 'path':52B,105C 'permiss':34B,63C,141C 'privileg':10A,92C 'requir':108C 'run':56B 'self':144C 'self-heal':143C 'servic':38B,101C,140C 'set':32B 'standalon':26B,69C,116C 'standard':111C,122C 'steam':130C 'system':9A,61B,96C 'titl':152C 'upon':146C 'user':7A,45B,89C 'version':75C,136C 'via':125C 'vulner':107C 'window':12A,24B,82C","nicknames":[],"mitigations":[],"who_affected":"Only Windows machines where the EA Javelin Anticheat standalone installer was run manually, per the sources. The sources say standard installations through the EA App and Steam are not affected, so teams that only use those paths can skip it. Shared Windows machines with multiple local non-admin users are the most exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T21:21:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N","cvss_by":"secure@ea.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96542","severity":null,"published_at":"2026-10-16T21:21:02+00:00","modified_at":"2026-10-19T20:51:14+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}