---
id: "CVE-2026-96542"
kind: "vulnerability"
aliases: ["CVE-2026-96542"]
title: "EA Javelin Anticheat installer lets local users gain SYSTEM privileges on Windows"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["ea-javelin-anticheat", "other", "windows"]
not_affected_if: ["default-config", "standard-install-via-ea-app-or-steam"]
published_at: "2026-10-16T21:21:02+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:31:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96542", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# EA Javelin Anticheat installer lets local users gain SYSTEM privileges on Windows

The standalone installer for EA Javelin Anticheat sets incorrect permissions on the EAAntiCheatService service, so a local non-admin user can change its configuration and executable path. That lets them run code as NT AUTHORITY\SYSTEM.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Javelin version on the Windows machine against `1.0.14329371`, `1.0.14547437`, `1.0.14789537` and `1.0.14940698`.
- Check whether the standalone installer was run manually; the sources say standard EA App and Steam installs are not affected.

## Fix

- Update EA Javelin Anticheat to `1.0.14940699` or later.
- Launching an integrated EA game title self-heals the service permissions, per the sources.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96542

## From the sources

Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam. This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_