CVE-2019-19741

Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipulation, a different issue than CVE-2019-19247 and CVE-2019-19248. When Origin.exe connects to the named pipe OriginClientService, the privileged service verifies the client's executable file instead of its in-memory process (which can be significantly different from the executable file due to, for example, DLL injection). Data transmitted over the pipe is encrypted using a static key. Instead of hooking the pipe communication directly via WriteFileEx(), this can be bypassed by hooking the EVP_EncryptUpdate() function of libeay32.dll. The pipe takes the command CreateDirectory to create a directory and adjust the directory DACL. Calls to this function can be intercepted, the directory and the DACL can be replaced, and the manipulated DACL is written. Arbitrary DACL write is further achieved by creating a hardlink in a user-controlled directory that points to (for example) a service binary. The DACL is then written to this service binary, which results in escalation of privileges.

• https://medium.com/%40tobiasgyoerfi/ea-origin-10-5-55-33574-createdirectory-arbitrary-dacl-write-privilege-escalation-cve-2019-19741-5f18adfabb27
• https://medium.com/%40tobiasgyoerfi/ea-origin-10-5-55-33574-createdirectory-arbitrary-dacl-write-privilege-escalation-cve-2019-19741-5f18adfabb27

Published

Feb 20, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19736MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Htt…6.1
• CVE-2019-19737MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Sam…8.8
• CVE-2019-19738log_file_viewer.php in MFScripts YetiShare 3.5.2 through 4.5…6.1
• CVE-2019-19739MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Sec…7.5
• CVE-2019-1974A vulnerability in the web-based management interface of Cis…9.8
• CVE-2019-19740Octeth Oempro 4.7 and 4.8 allow SQL injection. The parameter…9.8
• CVE-2019-19742On D-Link DIR-615 devices, the User Account Configuration pa…4.8
• CVE-2019-19743On D-Link DIR-615 devices, a normal user is able to create a…6.5
• CVE-2019-19745Contao 4.0 through 4.8.5 allows PHP local file inclusion. A …8.8
• CVE-2019-19746make_arrow in arrow.c in Xfig fig2dev 3.2.7b allows a segmen…5.5
• CVE-2019-19747NeuVector 3.1 when configured to allow authentication via Ac…9.8
• CVE-2019-19748The Work Time Calendar app before 4.7.1 for Jira allows XSS.6.1