CVE WatchOct 16, 2026

CVE-2026-96542

Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.147

CVSS

5.0

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 16, 2026 · Last modified: Oct 16, 2026 · CWE-732

EPSS · 30d

Not enough EPSS history yet.

Technical description

Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam. This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title.

Official references

catsandmalware.comhttps://catsandmalware.com/blog/eight-bytes-to-system/

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-964255.5 MED

—

——0Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus10h CVE-2026-964247.8 HIG

—

——0Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus10h CVE-2026-922286.5 MED

6.6%

——2The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.15h CVE-2026-1027405.8 MED

0.8%

——0The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default permissions and link-following file operations. A local user who can read the shared store can see download URLs, including embedded user information or query tokens. A local user who can write within or pre-create the affected shared store directory can plant a symbolic link that the client follows when saving state, truncating and overwriting a target file writable by the client process. The filesystem path is used when ResumableAsyncHandler decorates another AsyncHandler, while the no-argument constructors use a no-op processor and are unaffected. This issue is fixed in versions 2.16.1 and 3.0.12.10h CVE-2026-34014—

2.6%

——1An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later2d CVE-2026-34008—

1.8%

——1An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later2d