This CVE describes a permission‑management flaw defined as CWE‑732 in the standalone installer for EA Javelin Anticheat. The installer incorrectly assigns file‑system and service permissions that allow a local non‑administrative user to modify the configuration of the EAAntiCheatService and its executable path. By doing so, the user can elevate their privileges to the SYSTEM account, granting full control over the affected machine.

Affected systems are Windows PCs running Electronic Arts' EA Javelin Anticheat standalone installer. The vulnerable versions are 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698. Standard game installations via the EA App or Steam are not impacted by this flaw.

The CVSS base score is 5, indicating a medium severity. No EPSS score is currently available and the vulnerability is not listed in the CISA KEV catalog. The attack requires local access and manual execution of the installer; it does not involve remote code execution and does not affect user‑initiated game launches. Because the flaw permits a local user to gain SYSTEM rights, the potential impact is high if exploitation succeeds, but the overall risk remains moderate until the issue is patched.