Zero Day Initiative Discloses Remote Code Execution Vulnerability in OriginLab Origin Viewer
A critical vulnerability in OriginLab Origin Viewer allows remote attackers to execute arbitrary code by exploiting a flaw in OPJU file parsing, requiring user interaction.
Zero Day Initiative (ZDI) has publicly disclosed a critical remote code execution (RCE) vulnerability affecting OriginLab Origin Viewer. The flaw, tracked as CVE-2026-114558, resides within the software's handling of OPJU files. Attackers can exploit this vulnerability by crafting malicious OPJU files that, when opened by a user, trigger an out-of-bounds write condition.
The vulnerability stems from insufficient validation of user-supplied data during the parsing of OPJU files. This oversight allows an attacker to write data beyond the boundaries of an allocated buffer, leading to a heap corruption. Successful exploitation enables an attacker to execute arbitrary code within the context of the current process, potentially leading to a full system compromise.
Exploitation of this vulnerability requires a degree of user interaction. Specifically, a victim must either open a malicious OPJU file or visit a compromised webpage that hosts the malicious content. This social engineering vector is common for vulnerabilities that do not allow for pre-authentication or network-based exploitation, making user awareness and caution crucial.
The vulnerability carries a significant CVSS score of 7.8, classifying it as high severity. This score reflects the potential impact of arbitrary code execution, although the requirement for user interaction slightly mitigates the ease of exploitation compared to vulnerabilities that can be triggered remotely without any user involvement.
OriginLab has acknowledged the vulnerability and has released an update to address the issue. Users of OriginLab Origin Viewer are strongly advised to apply the available patch as soon as possible to mitigate the risk of exploitation. Further details on the patch and the specific CVE can be found on OriginLab's official security advisory page.
The disclosure timeline indicates that the vulnerability was initially reported to OriginLab on May 21, 2026. Following a coordinated disclosure process, ZDI released the public advisory on November 6, 2026, with an update to the advisory also published on the same day. The vulnerability was discovered and reported by researcher rgod.
This disclosure highlights the ongoing threat posed by vulnerabilities in specialized scientific and engineering software. While often used by a niche audience, these applications can be critical for organizations, and their compromise can have significant repercussions. The need for diligent security practices, including timely patching and user education, remains paramount across all software categories.
This advisory updates previous information by detailing a stack-based buffer overflow vulnerability in OriginLab Origin Viewer, specifically related to the parsing of OGWU files. The vulnerability, assigned CVE-2026-114563, allows for remote code execution with user interaction, and has a CVSS score of 7.8. OriginLab has released a patch for this issue.
The Zero Day Initiative has updated its advisory for this vulnerability, noting that OriginLab has released an update to correct the flaw. The advisory also includes credit to researcher rgod for discovering the issue. The vulnerability, tracked as CVE-2026-114562, allows for remote code execution through the parsing of malicious OGWU files.
The Zero Day Initiative advisory ZDI-26-885 details a heap-based buffer overflow vulnerability in OriginLab Origin Viewer, specifically within the parsing of OPJ files. This vulnerability, assigned CVE-2026-114568, has a CVSS score of 7.8 and requires user interaction for exploitation, allowing remote code execution in the context of the current process. OriginLab has since released an update to address this issue.
The vulnerability, identified as ZDI-26-883 and assigned CVE-2026-114566, specifically targets the OGM file parsing mechanism within OriginLab Origin Viewer. Attackers can exploit this memory corruption flaw to achieve remote code execution, though it requires user interaction such as opening a malicious file or visiting a compromised webpage. OriginLab has released an update to address this issue, with further details available on their official documentation site.
The Zero Day Initiative (ZDI) has updated its advisory for this vulnerability, noting that the vendor, OriginLab, has issued a patch. The advisory also includes a disclosure timeline, indicating the vulnerability was reported on May 21, 2026, and publicly disclosed on November 6, 2026, with the advisory itself being updated on the same day. The vulnerability was discovered by researcher rgod.
This advisory updates previous information regarding CVE-2026-114569, a heap-based buffer overflow in OriginLab Origin Viewer's OGWU file parsing. The update confirms that OriginLab has issued a patch to address this vulnerability, with further details available on their official CVE page.
This advisory updates previous information by detailing a specific remote code execution vulnerability (CVE-2026-114559) within OriginLab Origin Viewer, stemming from an out-of-bounds write during OGG file parsing. The vulnerability, which has a CVSS score of 7.8, requires user interaction and allows for arbitrary code execution in the context of the current process.
The Zero Day Initiative advisory ZDI-26-878 provides further technical details on the out-of-bounds write vulnerability in OriginLab Origin Viewer. The vulnerability, tracked as CVE-2026-114561, stems from improper validation of user-supplied data during OPJU file parsing, allowing attackers to write past allocated memory. OriginLab has released an update to address this issue, with coordinated public disclosure occurring on November 6, 2026.
This advisory updates the details for CVE-2026-114564, which affects OriginLab Origin Viewer. The vulnerability involves an out-of-bounds write during OGG file parsing, allowing for remote code execution with user interaction. OriginLab has released a patch for this issue, and the advisory now includes updated information on the fix.
This advisory, ZDI-26-882, specifically details a remote code execution vulnerability (CVE-2026-114565) within OriginLab Origin Viewer's OGG file parsing. Unlike the previously reported OPJU file parsing flaw, this new vulnerability stems from improper user-supplied data validation leading to an out-of-bounds write. OriginLab has released an update to address this specific issue, which carries a CVSS score of 7.8.
This advisory updates previous information regarding the OriginLab Origin Viewer vulnerability (CVE-2026-114567). The Zero Day Initiative has provided additional technical details on the out-of-bounds write vulnerability, which occurs during the parsing of OGWU files. The vendor, OriginLab, has issued a patch, and the coordinated public release of the advisory occurred on November 6, 2026.