---
id: "CVE-2026-114558"
page: "https://infrastack.ai/live/CVE-2026-114558"
kind: "vulnerability"
aliases: ["CVE-2026-114558"]
title: "OriginLab Origin Viewer: OPJU file parsing flaw allows remote code execution"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Origin Viewer", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}]
ecosystems: []
tags: ["desktop", "file-parsing", "origin-viewer", "other", "windows"]
not_affected_if: ["no-origin-viewer-installed", "not-installed"]
published_at: "2026-11-12T03:17:08+00:00"
first_seen_at: "2026-11-12T03:46:11+00:00"
updated_at: "2026-11-12T03:54:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114558", "first_seen_at": "2026-11-12T03:46:11+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-886/", "first_seen_at": "2026-11-12T03:54:21+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-886/", "https://docs.originlab.com/viewer/origin-viewer-release-notes.html"]}]
exploit_sources: []
---

# OriginLab Origin Viewer: OPJU file parsing flaw allows remote code execution

Link for people: https://infrastack.ai/live/CVE-2026-114558 (this .md is for agents)

OriginLab Origin Viewer has an out-of-bounds write when it parses OPJU files, so a crafted file can overwrite memory past an allocated buffer. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the current process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Origin Viewer affected unknown fixed no fixed version listed

## How to check

Check whether Origin Viewer (Windows) is installed and note its version in Help > About or the installer. Compare it with OriginLab's CVE page for CVE-2026-114558 once it is published. The latest build in the release notes is 10.4.0.25, but those notes do not name this CVE, so do not treat that build as confirmed fixed. Also check for OPJU files arriving from outside the team.

## Fix

OriginLab says it has issued an update (per ZDI). No fixed version is published yet in sources I could read: update Origin Viewer to the latest release from OriginLab.

## Timeline

- 2026-11-12T03:46:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114558
- 2026-11-12T03:54:21+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-886/ — ZDI-26-886 (credit rgod) says OriginLab issued an update, but the vendor page docs.originlab.com/cve/CVE-2026-114558 returns 404 and the release notes (latest 10.4.0.25, 2026-07-30) list other CVEs, not this one. Affected and fixed versions are unknown. ZDI-26-878 is a sibling with CVE-2026-114561.

## Documents

- [advisory] ZDI-26-886 OriginLab Origin Viewer OPJU File Parsing OOB Write RCE https://www.zerodayinitiative.com/advisories/ZDI-26-886/
- [mentions] Origin Viewer Release Notes https://docs.originlab.com/viewer/origin-viewer-release-notes.html

## From the sources

OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30738.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_