CVE-2026-96542: CWE-732 Incorrect Permission Assignment for Critical Resource in Electronic Arts EA Javelin Anticheat (EA Javelin Anticheat Installer)

The vulnerability CVE-2026-96542 is due to incorrect permission assignment in the standalone installer for EA Javelin Anticheat on Windows. Versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698 are affected. A local non-administrative user can exploit this by modifying the EAAntiCheatService service configuration and executable path to escalate privileges to NT AUTHORITY\SYSTEM. This requires manual, non-standard execution of the standalone installer and does not impact standard installations via the EA App or Steam. The issue is resolved in version 1.0.14940699 and later, where service permissions automatically self-heal upon launching an integrated EA game title.

Successful exploitation allows a local non-administrative user to gain SYSTEM-level privileges on the affected Windows system, potentially leading to full control over the machine. However, exploitation requires manual execution of the standalone installer and does not affect typical game installations, limiting the attack surface.

Upgrade to EA Javelin Anticheat standalone installer version 1.0.14940699 or later. For users of integrated EA game titles, service permissions self-heal automatically upon launching the game, mitigating the issue without additional action. Avoid manual execution of the vulnerable standalone installer versions.