CVE-2026-96542

Executive Summary

CVE-2026-96542 is an incorrect permission assignment (CWE-732) vulnerability in the standalone installer for EA Javelin Anticheat on Windows. Under the affected installer versions (1.0.14329371, 1.0.14547437, 1.0.14789537, 1.0.14940698), a local non-administrative user can modify the EAAntiCheatService service configuration and executable path and thereby elevate privileges to NT AUTHORITY\SYSTEM. Exploitation requires non-standard manual execution of the standalone installer; standard game installations distributed through the EA App and Steam are not affected. The issue is fixed in version 1.0.14940699 and later, and service permissions automatically self-heal upon launching an integrated EA game title.

Technical Analysis

The vulnerability class is CWE-732 (Incorrect Permission Assignment for Critical Resource). At its core, the installer creates a Windows service — EAAntiCheatService, which runs at the highest local privilege level (NT AUTHORITY\SYSTEM) — but assigns permissions to that service object that are too permissive for the security context in which it operates. A standard Windows service runs as SYSTEM, and its configuration (binary path, start type, security descriptor) is held in the registry and the Service Control Manager (SCM) database. When the discretionary access control (DACL) on the service object grants write or configuration-change rights to non-administrative users, any local standard user can alter where the service points or how it is configured.

The NVD description explicitly states the two primitive actions available to the attacker: modifying the EAAntiCheatService service configuration and the executable path. Modifying the executable path of a SYSTEM-run service is the canonical privilege-escalation primitive: the next time the service starts (or is restarted), the SCM launches the attacker-designated executable under the SYSTEM token. Modifying the service configuration (e.g., start type or the account the service runs as) is a complementary lever that can force the service to start on demand, restart after failure, or run under an attacker-chosen security context.

The attack surface is strictly local. The CVSS vector AV:L confirms the attacker must already hold a foothold on the host, PR:L confirms a low-privileged local account is sufficient, and UI:R indicates that some user interaction is required — consistent with the requirement that the standalone installer be manually executed by a user. AC:H (High attack complexity) reflects the preconditions: the standalone installer must be present and manually run, the affected installer version must be installed, and the attacker must be able to act on the service before it is re-secured. The S:U scope is unchanged because the impact stays within the same security authority, while C:H / I:L / A:N show that the dominant outcome is confidentiality loss (SYSTEM-level read access to the host) with limited integrity impact and no availability impact.

Critically, the vulnerability is not reachable through the standard distribution path. Installations performed through the EA App or Steam are unaffected, and the correction mechanism — permissions automatically self-healing upon launching an integrated EA game title — means an affected standalone install is remediated as soon as a legitimate integrated title is launched or the fixed installer is applied.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The chain below is inferred strictly from the vulnerability class and the NVD description; no implementation-level function names or paths are asserted beyond EAAntiCheatService.

1. Reconnaissance / target identification. The attacker, operating with a local non-administrative account on a Windows host, enumerates local services and their security descriptors to identify EAAntiCheatService. This is a standard post-compromise discovery step (ATT&CK TA0007). The attacker confirms the host has the standalone EA Javelin Anticheat installer applied at one of the affected versions rather than an EA App / Steam-managed install.

2. Triggering the flaw class. The attacker verifies whether the service object's permissions permit a non-administrative user to change the service configuration or its executable path — the precise condition CWE-732 describes. This is the vulnerability's root cause: the DACL on the service does not restrict configuration-change rights to administrators, so a standard user can issue SCM configuration changes without elevation.

3. Execution. Having write access to the service configuration, the attacker redirects the EAAntiCheatService executable path to an attacker-controlled binary and arranges for the service to start or restart. Because the service runs as NT AUTHORITY\SYSTEM, the SCM launches the attacker's binary under the SYSTEM token. No privilege-escalation exploit is needed — the flaw is an authorization/configuration weakness, not a memory-corruption bug.

4. Post-exploitation impact. The attacker now holds SYSTEM on the host. Per the CVSS subscores, the dominant result is high confidentiality impact — SYSTEM-level access to files, credentials, and kernel-adjacent interfaces — with limited integrity impact and no direct availability impact. From SYSTEM, the attacker can disable or tamper with the anticheat service itself, harvest local credentials, and pivot to further lateral movement. The AC:H rating and the manual-installer prerequisite constrain mass exploitation.

Impact Assessment

Affected assets are Windows endpoints where a user manually executed an affected standalone EA Javelin Anticheat installer (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, 1.0.14940698). Game installs delivered through the EA App or Steam are outside the blast radius.

The CVSS score is 5.0 (Medium) with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N:

• Confidentiality (C:H): The greatest impact. SYSTEM-level execution exposes the entire host — credential stores, protected files, and security tooling — to the attacker.
• Integrity (I:L): Limited. The service path/configuration can be altered, but the vector does not model broader system integrity loss.
• Availability (A:N): No modeled availability impact.
• Access Vector (AV:L): Local; remote exploitation is not modeled.
• Privileges Required (PR:L): A standard local user is sufficient — the crux of the privilege-escalation value.
• User Interaction (UI:R): A user must have manually run the standalone installer.
• Attack Complexity (AC:H): Preconditions (non-standard manual install, affected version, timing before self-heal) make this high-complexity and not a mass exploit.

Business impact centers on post-compromise escalation rather than initial access. An attacker who has already landed on a gaming or BYOD endpoint as a low-privileged user can leverage the weak service ACL to obtain SYSTEM. The integrity dimension is notable because obtaining SYSTEM on the same host as the anticheat agent allows tampering with the agent that is meant to guarantee game integrity. Because CISA KEV status is NO and there is no public exploit or in-the-wild evidence, this is not an emergency-patch priority for most enterprises, but it is directly relevant to gaming hosts, esports environments, and endpoints where low-privileged local accounts are the norm.

Detection Guidance

Sigma Rule

title: EA Javelin Anticheat Service Configuration or Path Modification (CVE-2026-96542)
id: 9f3c2e14-7b6a-4d21-9a0e-ea9654202601
status: experimental
description: Detects modification of the EAAntiCheatService service configuration or executable path consistent with privilege escalation via weak service permissions.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96542
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.privilege_escalation
  - attack.t1574.011
  - cve.2026.96542
logsource:
  product: windows
  service: security
  definition: Requires object access auditing enabled for services
detection:
  selection_service:
    EventID:
      - 4697
      - 7045
    ServiceName|contains: 'EAAntiCheatService'
  selection_registry:
    EventID: 4657
    ObjectName|contains: 'EAAntiCheatService'
  selection_cmd:
    EventID: 4688
    CommandLine|contains|all:
      - 'EAAntiCheatService'
      - 'config'
  condition: selection_service or selection_registry or selection_cmd
falsepositives:
  - Legitimate EA installer upgrades or self-healing service repair
level: high

YARA Rule

rule CVE_2026_96542_EAAntiCheatService_Modification
{
    meta:
        description = "Detects artifacts referencing EAAntiCheatService path/configuration tampering tied to CVE-2026-96542"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96542"
        date = "2026-01-01"
    strings:
        $svc = "EAAntiCheatService" ascii wide nocase
        $svc2 = "EA Javelin Anticheat" ascii wide nocase
        $bin = "ImagePath" ascii wide nocase
    condition:
        filesize < 5MB and uint16(0) == 0x5A4D and $svc and $svc2
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-96542 EA Javelin Anticheat service tampering activity (lateral/remote tooling indicative)"; flow:to_server,established; content:"EAAntiCheatService"; nocase; content:"config"; distance:0; nocase; classtype:attempted-admin; sid:9006542; rev:1;)

Elastic Detection

any where event.category == "process" and process.command_line : "*EAAntiCheatService*" and
  (process.command_line : "*config*" or process.command_line : "*ImagePath*" or process.command_line : "*binPath*")

Splunk SPL Query

(index=windows_security OR index=windows_system)
  (EventCode=4688 OR EventCode=4697 OR EventCode=7045 OR EventCode=4657)
  ("EAAntiCheatService")
  (CommandLine="*config*" OR CommandLine="*ImagePath*" OR ObjectName="*EAAntiCheatService*")
| stats count min(_time) as firstTime max(_time) as lastTime values(CommandLine) as cmd values(ObjectName) as obj by ComputerName, User
| where count > 0

Wazuh OSSEC Rule

<group name="windows,cve-2026-96542,privilege_escalation,">
  <rule id="100642" level="12">
    <if_sid>60000</if_sid>
    <field name="win.system.eventID">^7045$|^4697$|^4657$</field>
    <match>EAAntiCheatService</match>
    <description>CVE-2026-96542: Potential EAAntiCheatService configuration or executable path modification (privilege escalation)</description>
    <mitre>
      <id>T1574.011</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). However, the NVD description itself states the issue is corrected in version 1.0.14940699 and later; treat that as the vendor-stated fix version.

1. Immediate mitigations

   • Avoid distributing or manually running the standalone EA Javelin Anticheat installer at affected versions (1.0.14329371, 1.0.14547437, 1.0.14789537, 1.0.14940698).
   • Where an affected standalone install exists, launch an integrated EA game title — per the description, service permissions automatically self-heal, restoring the intended ACL on EAAntiCheatService.
   • As a compensating control, review local service ACLs so only administrators hold configuration-change rights over EAAntiCheatService, and restrict low-privileged local accounts on gaming endpoints.
   • Monitor for ServiceName=*EAAntiCheatService* events (4697, 7045, 4657) and for SCM config commands referencing the service.

2. Patch / upgrade steps

   • Replace any affected standalone installer with version 1.0.14940699 or later.
   • Audit hosts for the affected installer versions and re-image/reinstall where the standalone path was used.
   • Confirm service configuration and executable path point to the legitimate EA binary post-upgrade.

3. Long-term hardening

   • Prefer EA App / Steam-managed game installations, which are explicitly not affected.
   • Enforce least privilege on local service objects; audit DACLs on SYSTEM-run services as a standing control.
   • Track EA Javelin Anticheat service-permission advisories and validate fixed versions against the vendor.
   • Maintain behavioral detection (T1574.011 — Service Registry Permissions Weakness) for all SYSTEM services to catch analogous CWE-732 weaknesses.

References

• NVD — CVE-2026-96542: https://nvd.nist.gov/vuln/detail/CVE-2026-96542
• CWE-732: Incorrect Permission Assignment for Critical Resource — https://cwe.mitre.org/data/definitions/732.html
• MITRE ATT&CK T1574.011: Hijack Execution Flow — Services Registry Permissions Weakness — https://attack.mitre.org/techniques/T1574/011/
• EA Javelin Anticheat — vendor product information (refer to EA's official anticheat documentation for the fixed version 1.0.14940699)
• CISA KEV Catalog (CVE-2026-96542 not listed as of this writing) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, Nuclei template, or exploit code was identified. CISA KEV status is NO, and no in-the-wild exploitation or associated threat actor campaigns were reported in the supplied data. EPSS has not yet been scored by FIRST.org.