{"id":"CVE-2026-114558","kind":"vulnerability","aliases":["CVE-2026-114558"],"related":[],"title":"OriginLab Origin Viewer: OPJU file parsing flaw allows remote code execution","description":"OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30738.","summary":"OriginLab Origin Viewer has an out-of-bounds write when it parses OPJU files, so a crafted file can overwrite memory past an allocated buffer. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the current process.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Origin Viewer","fixed":[],"affected":"unknown","ecosystem":"vendor"}],"ecosystems":[],"tags":["desktop","file-parsing","origin-viewer","other","windows"],"not_affected_if":["no-origin-viewer-installed","not-installed"],"how_to_check":"Check whether Origin Viewer (Windows) is installed and note its version in Help > About or the installer. Compare it with OriginLab's CVE page for CVE-2026-114558 once it is published. The latest build in the release notes is 10.4.0.25, but those notes do not name this CVE, so do not treat that build as confirmed fixed. Also check for OPJU files arriving from outside the team.","fix":"OriginLab says it has issued an update (per ZDI). No fixed version is published yet in sources I could read: update Origin Viewer to the latest release from OriginLab.","status":"open","published_at":"2026-11-12T03:17:08+00:00","first_seen_at":"2026-11-12T03:46:11+00:00","triaged_at":"2026-11-12T03:47:44+00:00","updated_at":"2026-11-12T03:54:21+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T03:47:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"OriginLab Origin Viewer: OPJU file parsing flaw allows remote code execution","impact":"high","summary":"OriginLab Origin Viewer has an out-of-bounds write when it parses OPJU files, so a crafted file can overwrite memory past an allocated buffer. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the current process.","audience":"businesses","category":"other","nicknames":[],"who_cares":["origin-viewer","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs in the viewer process after opening a malicious file.","analyst_note":"Find the affected and fixed Origin Viewer versions from the ZDI advisory (ZDI-CAN-30738) or the vendor, since the sources give none.","how_to_check":"- Check whether Origin Viewer is installed on the machine and note its version, which the sources do not give\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-origin-viewer-installed"],"who_is_affected":"Teams that use OriginLab Origin Viewer to open OPJU files, especially on machines that receive files from outside sources. The sources do not name affected versions, so whether a given install is exposed is unknown.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000719,"input_tokens":4687,"output_tokens":501,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Origin Viewer versions from the ZDI advisory (ZDI-CAN-30738) or the vendor, since the sources give none.","search":"'-114558':14A,17A '-2026':13A,16A '30738':192C 'affect':106C 'alloc':53B,169C 'allow':8A,98C 'arbitrari':103C 'attack':56B,100C,173C 'bound':37B,90C 'buffer':54B 'code':10A,73B,93C,104C,180C 'context':76B,183C 'craft':46B 'current':79B,186C 'cve':12A,15A 'data':157C,170C 'desktop':20B 'end':166C 'execut':11A,94C,102C,179C 'exist':137C 'exploit':117C 'file':5A,22B,43B,47B,65B,85C,133C,143C 'file-pars':21B 'flaw':7A,136C 'get':58B 'instal':107C 'interact':113C 'issu':145C 'lack':149C 'leverag':175C 'malici':64B,69B,127C,132C 'memori':50B 'must':124C 'open':62B,130C 'opju':4A,42B,84C,142C 'origin':2A,18A,25B,30B,82C,110C 'origin-view':24B 'originlab':1A,29B,81C,109C 'out-of-bound':34B,87C 'overwrit':49B 'page':70B,128C 'pars':6A,23B,41B,86C,140C 'past':51B,164C 'process':80B,187C 'proper':151C 'remot':9A,92C,99C 'requir':115C 'result':146C,160C 'run':72B 'specif':135C 'structur':171C 'suppli':156C 'target':123C 'user':60B,112C,155C 'user-suppli':154C 'valid':152C 'viewer':3A,19A,26B,31B,83C,111C 'visit':67B,125C 'vulner':95C,97C,119C,177C 'window':28B 'within':138C 'write':38B,91C,163C 'zdi':190C 'zdi-can':189C","nicknames":[],"mitigations":[],"who_affected":"Anyone who installs Origin Viewer, the free viewer for Origin project files, on Windows and opens OPJU files from outside sources. Exploitation needs the user to open a crafted file or visit a malicious page. Teams that do not use Origin Viewer can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["originviewer","viewer"],"ptokens":["origin","viewer"],"labels":["desktop","fileparsing","high","originviewer","other","windows"],"campaign_type":null,"search_a":"'-114558':14A,17A '-2026':13A,16A 'allow':8A 'code':10A 'cve':12A,15A 'execut':11A 'file':5A 'flaw':7A 'opju':4A 'origin':2A,18A 'originlab':1A 'pars':6A 'remot':9A 'viewer':3A,19A","search_b":"'alloc':53B 'attack':56B 'bound':37B 'buffer':54B 'code':73B 'context':76B 'craft':46B 'current':79B 'desktop':20B 'file':22B,43B,47B,65B 'file-pars':21B 'get':58B 'malici':64B,69B 'memori':50B 'open':62B 'opju':42B 'origin':25B,30B 'origin-view':24B 'originlab':29B 'out-of-bound':34B 'overwrit':49B 'page':70B 'pars':23B,41B 'past':51B 'process':80B 'run':72B 'user':60B 'viewer':26B,31B 'visit':67B 'window':28B 'write':38B","search_c":"'30738':192C 'affect':106C 'alloc':169C 'allow':98C 'arbitrari':103C 'attack':100C,173C 'bound':90C 'code':93C,104C,180C 'context':183C 'current':186C 'data':157C,170C 'end':166C 'execut':94C,102C,179C 'exist':137C 'exploit':117C 'file':85C,133C,143C 'flaw':136C 'instal':107C 'interact':113C 'issu':145C 'lack':149C 'leverag':175C 'malici':127C,132C 'must':124C 'open':130C 'opju':84C,142C 'origin':82C,110C 'originlab':81C,109C 'out-of-bound':87C 'page':128C 'pars':86C,140C 'past':164C 'process':187C 'proper':151C 'remot':92C,99C 'requir':115C 'result':146C,160C 'specif':135C 'structur':171C 'suppli':156C 'target':123C 'user':112C,155C 'user-suppli':154C 'valid':152C 'viewer':83C,111C 'visit':125C 'vulner':95C,97C,119C,177C 'within':138C 'write':91C,163C 'zdi':190C 'zdi-can':189C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114558","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114558","severity":null,"published_at":"2026-11-12T03:17:08+00:00","modified_at":"2026-11-12T03:17:08+00:00","first_seen_at":"2026-11-12T03:46:11+00:00","fetched_at":"2026-11-12T03:46:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114558:3700","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-886/","severity":null,"published_at":"2026-11-12T03:54:21+00:00","modified_at":"2026-11-12T03:54:21+00:00","first_seen_at":"2026-11-12T03:54:21+00:00","fetched_at":"2026-11-12T03:54:21+00:00","note":"ZDI-26-886 (credit rgod) says OriginLab issued an update, but the vendor page docs.originlab.com/cve/CVE-2026-114558 returns 404 and the release notes (latest 10.4.0.25, 2026-07-30) list other CVEs, not this one. Affected and fixed versions are unknown. ZDI-26-878 is a sibling with CVE-2026-114561.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-886/","https://docs.originlab.com/viewer/origin-viewer-release-notes.html"]}],"documents":[{"id":131574,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-886/","title":"ZDI-26-886 OriginLab Origin Viewer OPJU File Parsing OOB Write RCE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":131543,"url":"https://docs.originlab.com/viewer/origin-viewer-release-notes.html","title":"Origin Viewer Release Notes","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}