{"id":"CVE-2026-114559","kind":"vulnerability","aliases":["CVE-2026-114559"],"related":[],"title":"OriginLab Origin Viewer: OGG file parsing flaw allows remote code execution","description":"OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30431.","summary":"Out-of-bounds write in OriginLab Origin Viewer's OGG file parser. A user who opens a crafted OGG file, or visits a malicious page that leads to one, lets the attacker run code as the viewer process. ZDI rates it CVSS 7.8 (local, user interaction). ZDI says OriginLab has issued an update, but the affected and fixed versions are not stated.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OriginLab Origin Viewer","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["file-parsing","origin-viewer","originlab","other","user-interaction","windows"],"not_affected_if":["no-ogg-files-opened"],"how_to_check":"Inventory Origin Viewer installs (Windows). Affected version range is not published in ZDI-26-876; check OriginLab's CVE page https://docs.originlab.com/cve/CVE-2026-114559 for the fixed build. Release notes show the latest Windows build is 10.4.0.25 (2026-07-30), but that note does not list this CVE.","fix":"OriginLab says an update exists (per ZDI-26-876). Fixed version not confirmed; update Origin Viewer to the latest build from OriginLab and avoid opening untrusted OGG files meanwhile.","status":"open","published_at":"2026-11-12T03:17:08+00:00","first_seen_at":"2026-11-12T03:46:11+00:00","triaged_at":"2026-11-12T03:47:41+00:00","updated_at":"2026-11-12T03:54:21+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T03:47:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OriginLab Origin Viewer: OGG file parsing flaw allows remote code execution","impact":"high","summary":"OriginLab Origin Viewer has an out-of-bounds write when it parses OGG files. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the current process.","audience":"businesses","category":"other","nicknames":[],"who_cares":["originlab","origin-viewer","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"code runs in the viewer's process for the user","analyst_note":"Find affected and fixed Origin Viewer versions and any vendor advisory at the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-114559 and the ZDI advisory for ZDI-CAN-30431.","how_to_check":"- unknown","plain_action":"","product_name":"OriginLab Origin Viewer","needs_analyst":true,"not_affected_if":["no-ogg-files-opened"],"who_is_affected":"Teams that run OriginLab Origin Viewer and open OGG files from untrusted sources or links are exposed. Installations that never open OGG files from outside sources have less exposure. The sources do not list affected versions.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4684,"output_tokens":505,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed Origin Viewer versions and any vendor advisory at the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-114559 and the ZDI advisory for ZDI-CAN-30431.","search":"'-114559':14A,17A '-2026':13A,16A '30431':207C '7.8':76B 'affect':89B,121C 'alloc':184C 'allow':8A,113C 'arbitrari':118C 'attack':65B,115C,188C 'bound':36B,105C 'code':10A,67B,108C,119C,195C 'context':198C 'craft':51B 'current':201C 'cve':12A,15A 'cvss':75B 'data':172C,185C 'end':181C 'execut':11A,109C,117C,194C 'exist':152C 'exploit':132C 'file':5A,22B,44B,53B,100C,148C,158C 'file-pars':21B 'fix':91B 'flaw':7A,151C 'instal':122C 'interact':31B,79B,128C 'issu':84B,160C 'lack':164C 'lead':60B 'let':63B 'leverag':190C 'local':77B 'malici':57B,142C,147C 'must':139C 'ogg':4A,43B,52B,99C,157C 'one':62B 'open':49B,145C 'origin':2A,19A,25B,40B,97C,125C 'origin-view':24B 'originlab':1A,18A,27B,39B,82B,96C,124C 'out-of-bound':33B,102C 'page':58B,143C 'pars':6A,23B,101C,155C 'parser':45B 'past':179C 'process':71B,202C 'proper':166C 'rate':73B 'remot':9A,107C,114C 'requir':130C 'result':161C,175C 'run':66B 'say':81B 'specif':150C 'state':95B 'structur':186C 'suppli':171C 'target':138C 'updat':86B 'user':30B,47B,78B,127C,170C 'user-interact':29B 'user-suppli':169C 'valid':167C 'version':92B 'viewer':3A,20A,26B,41B,70B,98C,126C 'visit':55B,140C 'vulner':110C,112C,134C,192C 'window':32B 'within':153C 'write':37B,106C,178C 'zdi':72B,80B,205C 'zdi-can':204C","nicknames":[],"mitigations":[],"who_affected":"Anyone running OriginLab Origin Viewer who opens OGG files from untrusted sources, such as files received by email or downloaded. Exact affected versions are not published. Teams that don't have Origin Viewer installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["originlaboriginviewer","originviewer"],"ptokens":["origin","originlab","viewer"],"labels":["fileparsing","high","originlab","originviewer","other","userinteraction","vendor","windows"],"campaign_type":null,"search_a":"'-114559':14A,17A '-2026':13A,16A 'allow':8A 'code':10A 'cve':12A,15A 'execut':11A 'file':5A 'flaw':7A 'ogg':4A 'origin':2A,19A 'originlab':1A,18A 'pars':6A 'remot':9A 'viewer':3A,20A","search_b":"'7.8':76B 'affect':89B 'attack':65B 'bound':36B 'code':67B 'craft':51B 'cvss':75B 'file':22B,44B,53B 'file-pars':21B 'fix':91B 'interact':31B,79B 'issu':84B 'lead':60B 'let':63B 'local':77B 'malici':57B 'ogg':43B,52B 'one':62B 'open':49B 'origin':25B,40B 'origin-view':24B 'originlab':27B,39B,82B 'out-of-bound':33B 'page':58B 'pars':23B 'parser':45B 'process':71B 'rate':73B 'run':66B 'say':81B 'state':95B 'updat':86B 'user':30B,47B,78B 'user-interact':29B 'version':92B 'viewer':26B,41B,70B 'visit':55B 'window':32B 'write':37B 'zdi':72B,80B","search_c":"'30431':207C 'affect':121C 'alloc':184C 'allow':113C 'arbitrari':118C 'attack':115C,188C 'bound':105C 'code':108C,119C,195C 'context':198C 'current':201C 'data':172C,185C 'end':181C 'execut':109C,117C,194C 'exist':152C 'exploit':132C 'file':100C,148C,158C 'flaw':151C 'instal':122C 'interact':128C 'issu':160C 'lack':164C 'leverag':190C 'malici':142C,147C 'must':139C 'ogg':99C,157C 'open':145C 'origin':97C,125C 'originlab':96C,124C 'out-of-bound':102C 'page':143C 'pars':101C,155C 'past':179C 'process':202C 'proper':166C 'remot':107C,114C 'requir':130C 'result':161C,175C 'specif':150C 'structur':186C 'suppli':171C 'target':138C 'user':127C,170C 'user-suppli':169C 'valid':167C 'viewer':98C,126C 'visit':140C 'vulner':110C,112C,134C,192C 'within':153C 'write':106C,178C 'zdi':205C 'zdi-can':204C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114559","severity":null,"published_at":"2026-11-12T03:17:08+00:00","modified_at":"2026-11-12T03:17:08+00:00","first_seen_at":"2026-11-12T03:46:11+00:00","fetched_at":"2026-11-12T03:46:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114559:3699","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-876/","severity":null,"published_at":"2026-11-12T03:54:21+00:00","modified_at":"2026-11-12T03:54:21+00:00","first_seen_at":"2026-11-12T03:54:21+00:00","fetched_at":"2026-11-12T03:54:21+00:00","note":"Primary: ZDI-26-876 (reported by rgod, published 2026-11-06). ZDI says OriginLab issued an update, links docs.originlab.com/cve/CVE-2026-114559 (page empty to my fetch). Vendor release notes list 10.4.0.25 (2026-07-30) fixing four other CVEs, not this one; fixed version unknown. No exploitation or PoC seen.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-876/","https://docs.originlab.com/viewer/origin-viewer-release-notes.html"]}],"documents":[{"id":131573,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-876/","title":"ZDI-26-876: OriginLab Origin Viewer OGG File Parsing OOB Write RCE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":131543,"url":"https://docs.originlab.com/viewer/origin-viewer-release-notes.html","title":"Origin Viewer Release Notes","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}