This page lists publicly disclosed CVE vulnerabilities affecting ea origin (linked via NVD CPE). Each row includes severity scores, summaries, and publication dates to help identify and analyze security issues.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2020-27708 | A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to either Administrator or System. Once the user has obtained elevated access, they may be able to take control of the system and perform actions otherwise reserved for high privileged users or system Administrators. | [email protected] | 7.8 | 0.13% | 2020-11-02 | 2024-11-21 |
| CVE-2019-19741 | Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipulation, a different issue than CVE-2019-19247 and CVE-2019-19248. When Origin.exe connects to the named pipe OriginClientService, the privileged service verifies the client's executable file instead of its in-memory process (which can be significantly different from the executable file due to, for example, DLL injection). Data transmitted over the pipe is encrypted using a stati | [email protected] | 7.8 | 0.06% | 2020-02-20 | 2024-11-21 |
| CVE-2019-19248 | Electronic Arts Origin through 10.5.x allows Elevation of Privilege (issue 2 of 2). | [email protected] | 7.8 | 0.04% | 2019-12-12 | 2024-11-21 |
| CVE-2019-19247 | Electronic Arts Origin through 10.5.x allows Elevation of Privilege (issue 1 of 2). | [email protected] | 7.8 | 0.13% | 2019-12-12 | 2024-11-21 |
| CVE-2019-12828 | An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to inject additional arguments into the Origin process and ultimately leverage code execution by loading a backdoored Qt plugin remotely via the platformpluginpath argument supplied with a Windows network share. | [email protected] | 8.8 | 11.67% | 2019-06-14 | 2024-11-21 |
| CVE-2019-11354 | The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices communication. | [email protected] | 7.8 | 40.73% | 2019-04-19 | 2024-11-21 |