OriginLab Origin Viewer Vulnerable to Remote Code Execution via Malicious OGW Files

A significant security vulnerability has been identified in OriginLab's Origin Viewer software, potentially exposing users to remote code execution (RCE). The flaw, designated CVE-2026-18294, resides within the application's handling of Origin Graphic Worksheet (OGW) files. Attackers can exploit this vulnerability by enticing users to open a malicious OGW file or by directing them to a compromised webpage that hosts such a file.

The core of the issue lies in the improper parsing of OGW files. The software fails to adequately validate user-supplied data during this process, leading to a memory corruption condition. This corruption can be leveraged by a malicious actor to execute arbitrary code within the context of the currently running Origin Viewer process. The severity of this vulnerability is underscored by its CVSS score of 7.8, classifying it as high.

Exploitation of this vulnerability requires a degree of user interaction. Unlike some other RCE flaws that can be triggered remotely without any user action, this one necessitates that the target user either opens a malicious file that has been delivered through various means (such as email attachments or downloads) or visits a malicious website. This user-centric attack vector is common for vulnerabilities found in file parsing components.

OriginLab has acknowledged the vulnerability and has released an update to address the security risk. Users of OriginLab Origin Viewer are strongly advised to apply the available patch as soon as possible to mitigate the risk of exploitation. Further details regarding the patch and the specific fix can be found on OriginLab's official documentation portal.

The vulnerability was initially reported to OriginLab on April 8, 2026. Following a coordinated disclosure process, the advisory was publicly released on August 11, 2026, with an update to the advisory also published on the same day. This timeline indicates a typical responsible disclosure process, allowing the vendor time to develop and distribute a fix before public knowledge becomes widespread.

The discovery and reporting of this vulnerability are credited to security researcher rgod. Vulnerabilities in file parsing components are a frequent target for attackers, as they often present a straightforward path to code execution if not properly secured. The widespread use of data visualization and analysis tools like Origin Viewer makes such vulnerabilities a concern for a broad range of users, particularly in scientific and engineering fields.

This incident serves as a reminder of the importance of keeping software updated, especially applications that handle user-provided or externally sourced files. Organizations and individuals using OriginLab Origin Viewer should prioritize applying the security update to protect their systems from potential compromise. The vulnerability highlights the ongoing challenges in securing complex software that relies on parsing diverse file formats.

This advisory from Zero Day Initiative (ZDI-26-550) details a remote code execution vulnerability in OriginLab OriginPro, distinct from the previously reported flaw in Origin Viewer (CVE-2026-18294). The new vulnerability, CVE-2026-18291, stems from improper parsing of OGW files, leading to memory corruption and allowing arbitrary code execution in the context of the current process. While both vulnerabilities involve OGW file parsing and affect OriginLab products, ZDI-26-550 targets the full OriginPro application and has a CVSS score of 7.8, whereas the earlier advisory focused on Origin Viewer.

Zero Day Initiative has publicly disclosed a new critical vulnerability, ZDI-26-552, affecting OriginLab Origin Viewer. This vulnerability, identified as CVE-2026-18293, is distinct from the previously reported OGW file parsing flaw (CVE-2026-18294) but also allows for remote code execution through out-of-bounds writes when parsing OPJ files. The CVSS score for this new vulnerability is rated at 7.8, requiring user interaction to exploit.