CVE-2026-96542: EA Javelin Anticheat Installer Local Privilege Escalation
Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam. This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EA Javelin Anticheat Installerto a version that resolves this vulnerability.Fixed in 1.0.14940699 - Operational
Launch an integrated EA game title to trigger automatic self-healing of the service permissions.
Event History
Frequently Asked Questions
Which installations are exposed?
Only systems where the standalone installer was executed manually are affected. Standard game installations through the EA App or Steam are not affected.
What does an attacker need to exploit this issue?
The attacker needs local access as a non-administrative user and must be able to modify the EAAntiCheatService configuration and executable path. Exploitation also requires user interaction and has high attack complexity.
What can be done if the installer cannot be updated immediately?
Launching an integrated EA game title causes the service permissions to self-heal. Updating to version 1.0.14940699 or later corrects the issue.
How can I determine whether a system may be affected?
Check whether the manually run standalone installer is one of versions 1.0.14329371, 1.0.14547437, 1.0.14789537, or 1.0.14940698. Systems using only standard EA App or Steam game installations are not affected.