EA Javelin Anticheat EUVD-2026-103174

Exploitation requires that the EA Javelin Anticheat STANDALONE installer was manually executed (a non-standard deployment) - standard installations via the EA App or Steam are explicitly NOT affected. The attacker must already hold a local, non-administrative account on the Windows host; the standalone installer leaves the EAAntiCheatService with weak permissions allowing that user to modify the service configuration and executable path, which the service then runs as NT AUTHORITY\SYSTEM. Key limiting factors: no remote vector (local access only), an existing low-privilege account is required, the vulnerable state exists only for the non-default standalone-installer path, affected versions are 1.0.14329371/1.0.14547437/1.0.14789537/1.0.14940698, and the vulnerable service permissions self-heal automatically as soon as any integrated EA game title is launched, closing the exploitation window. Fixed in 1.0.14940699 and later.

This is a locally-exploitable privilege escalation (CWE-732) rated CVSS 5.0 by the vendor (AV:L/AC:H/PR:L/UI:R), meaning an attacker needs an existing low-privileged account on the Windows host and specific non-default conditions. No EPSS score and no CISA KEV entry were provided, and the input contains no explicit POC flag, so there is no signal of widespread or active exploitation at time of analysis. The lone reference is a third-party research blog ('eight bytes to system') that very likely documents the technique in exploit-grade detail, which raises practical reproducibility even though it is not formally flagged as a POC. The vendor CVSS impact metrics (C:H/I:L/A:N) appear internally inconsistent with the stated outcome - escalation to NT AUTHORITY\SYSTEM is a full host compromise and should carry I:H/A:H, so the published 5.0 likely understates technical impact; my independent assessment raises it to ~6.9. However, the real-world priority is materially reduced by two hard constraints the description states explicitly: the flaw only exists when the standalone installer was run manually (NOT for standard EA App or Steam installs), and service permissions self-heal the moment any integrated EA game title is launched. Net: a genuine SYSTEM-level LPE for a narrow, non-default deployment profile - treat as medium priority for environments using the standalone installer, low priority otherwise. Verify POC/exploitation status with the referenced blog and vendor before escalating.

On a Windows machine where EA Javelin Anticheat was deployed via the standalone installer, a local non-administrative user discovers that the EAAntiCheatService has overly permissive ACLs. The user rewrites the service's binary path (or configuration) to point at an attacker-controlled executable, then triggers a service restart so the payload runs as NT AUTHORITY\SYSTEM, yielding full local compromise. A detailed third-party technical write-up of the technique appears to be publicly available, though no POC is explicitly flagged in the input metadata.