Privilege Escalation in EA Javelin Anticheat by Electronic Arts
CVE-2026-96542

5MEDIUM

Key Information:

Vendor

Electronic Arts

Status
Ea Javelin Anticheat (ea Javelin Anticheat Installer)
Vendor
CVE Published:
16 October 2026

What is CVE-2026-96542?

An improper permission assignment vulnerability exists in the standalone installer for EA Javelin Anticheat. This affects specific versions allowing local non-administrative users to potentially elevate their privileges to that of NT AUTHORITY\SYSTEM. By modifying service configurations and executable paths, users can exploit this weakness. Importantly, this condition arises only through a non-standard manual installation of the standalone package and does not impact standard game installations via the EA App and Steam. The vulnerability has been addressed in version 1.0.14940699 and later, where service permissions automatically restore upon launching an integrated EA game.

Affected Version(s)

EA Javelin Anticheat (EA Javelin Anticheat Installer) Windows 1.0.14329371 (Specific affected standalone versions: 1.0.14329371, 1.0.14547437, 1.0.14789537, 1.0.14940698)

References

https://catsandmalware.com/blog/eight-bytes-to-system/
technical-descriptionthird-party-advisory

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Miles Norris (mn@catsandmalware.com)
.