Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities

    CVE-2026-96542 (GCVE-0-2026-96542)

    Vulnerability from cvelistv5 – Published: 2026-10-16 21:00 – Updated: 2026-10-19 14:31
    VLAI
    Title
    EA Javelin Anticheat Installer Local Privilege Escalation
    Summary
    Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam. This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title.
    Severity
    5 (Medium)
    CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-19 14:30 UTC
    CWE
    • CWE-732 - Incorrect Permission Assignment for Critical Resource
    Assigner
    EA CNA under the mitre root
    CNA scorecard – unranked: 1 record in the last 180 days, 10 needed details
    References
    URL Tags
    https://catsandmalware.com/blog/eight-bytes-to-system/ technical-descriptionthird-party-advisory
    Impacted products
    Vendor Product Version
    Electronic Arts EA Javelin Anticheat (EA Javelin Anticheat Installer) Affected: 1.0.14329371 (Specific affected standalone versions: 1.0.14329371, 1.0.14547437, 1.0.14789537, 1.0.14940698) (custom)
    		Create a notification for this product.
    Date Public
    2026-10-16 21:00
    Credits
    Miles Norris (mn@catsandmalware.com)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96542",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T14:30:41.346248Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T14:31:10.432Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Standalone Installer / EAAntiCheatService configuration"
          ],
          "platforms": [
            "Windows"
          ],
          "product": "EA Javelin Anticheat (EA Javelin Anticheat Installer)",
          "vendor": "Electronic Arts",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.14329371 (Specific affected standalone versions: 1.0.14329371, 1.0.14547437, 1.0.14789537, 1.0.14940698)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Miles Norris (mn@catsandmalware.com)"
        }
      ],
      "datePublic": "2026-10-16T21:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam.\u0026nbsp;This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title."
            }
          ],
          "value": "Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam.\u00a0This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T21:00:54.224Z",
        "orgId": "442d7a9f-d735-4edc-91a9-bdd618cbff51",
        "shortName": "EA"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "third-party-advisory"
          ],
          "url": "https://catsandmalware.com/blog/eight-bytes-to-system/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "EA Javelin Anticheat Installer Local Privilege Escalation",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "442d7a9f-d735-4edc-91a9-bdd618cbff51",
    "assignerShortName": "EA",
    "cveId": "CVE-2026-96542",
    "datePublished": "2026-10-16T21:00:54.224Z",
    "dateReserved": "2026-09-23T12:30:02.712Z",
    "dateUpdated": "2026-10-19T14:31:10.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2020-27708 (GCVE-0-2020-27708)

    Vulnerability from cvelistv5 – Published: 2020-10-30 16:23 – Updated: 2024-08-04 16:18
    VLAI
    Summary
    A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to either Administrator or System. Once the user has obtained elevated access, they may be able to take control of the system and perform actions otherwise reserved for high privileged users or system Administrators.
    Severity
    No CVSS data available.
    CWE
    • Elevation of Privilege
    Assigner
    EA CNA under the mitre root
    CNA scorecard – unranked: 1 record in the last 180 days, 10 needed details
    References
    Impacted products
    Vendor Product Version
    n/a Origin Affected: 10.5.86 (or earlier)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:18:45.679Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ea.com/security/news/easec-2020-002-elevation-of-privilege-vulnerability-in-origin-client"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Origin",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "10.5.86 (or earlier)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to either Administrator or System. Once the user has obtained elevated access, they may be able to take control of the system and perform actions otherwise reserved for high privileged users or system Administrators."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of Privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-30T16:23:56.000Z",
        "orgId": "442d7a9f-d735-4edc-91a9-bdd618cbff51",
        "shortName": "EA"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ea.com/security/news/easec-2020-002-elevation-of-privilege-vulnerability-in-origin-client"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@ea.com",
          "ID": "CVE-2020-27708",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Origin",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "10.5.86 (or earlier)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to either Administrator or System. Once the user has obtained elevated access, they may be able to take control of the system and perform actions otherwise reserved for high privileged users or system Administrators."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Elevation of Privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ea.com/security/news/easec-2020-002-elevation-of-privilege-vulnerability-in-origin-client",
              "refsource": "MISC",
              "url": "https://www.ea.com/security/news/easec-2020-002-elevation-of-privilege-vulnerability-in-origin-client"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "442d7a9f-d735-4edc-91a9-bdd618cbff51",
    "assignerShortName": "EA",
    "cveId": "CVE-2020-27708",
    "datePublished": "2020-10-30T16:23:56.000Z",
    "dateReserved": "2020-10-26T00:00:00.000Z",
    "dateUpdated": "2024-08-04T16:18:45.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}