---
id: "CVE-2026-114559"
page: "https://infrastack.ai/live/CVE-2026-114559"
kind: "vulnerability"
aliases: ["CVE-2026-114559"]
title: "OriginLab Origin Viewer: OGG file parsing flaw allows remote code execution"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "OriginLab Origin Viewer", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["file-parsing", "origin-viewer", "originlab", "other", "user-interaction", "windows"]
not_affected_if: ["no-ogg-files-opened"]
published_at: "2026-11-12T03:17:08+00:00"
first_seen_at: "2026-11-12T03:46:11+00:00"
updated_at: "2026-11-12T03:54:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114559", "first_seen_at": "2026-11-12T03:46:11+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-876/", "first_seen_at": "2026-11-12T03:54:21+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-876/", "https://docs.originlab.com/viewer/origin-viewer-release-notes.html"]}]
exploit_sources: []
---

# OriginLab Origin Viewer: OGG file parsing flaw allows remote code execution

Link for people: https://infrastack.ai/live/CVE-2026-114559 (this .md is for agents)

Out-of-bounds write in OriginLab Origin Viewer's OGG file parser. A user who opens a crafted OGG file, or visits a malicious page that leads to one, lets the attacker run code as the viewer process. ZDI rates it CVSS 7.8 (local, user interaction). ZDI says OriginLab has issued an update, but the affected and fixed versions are not stated.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:OriginLab Origin Viewer affected range not listed fixed no fixed version listed

## How to check

Inventory Origin Viewer installs (Windows). Affected version range is not published in ZDI-26-876; check OriginLab's CVE page https://docs.originlab.com/cve/CVE-2026-114559 for the fixed build. Release notes show the latest Windows build is 10.4.0.25 (2026-07-30), but that note does not list this CVE.

## Fix

OriginLab says an update exists (per ZDI-26-876). Fixed version not confirmed; update Origin Viewer to the latest build from OriginLab and avoid opening untrusted OGG files meanwhile.

## Timeline

- 2026-11-12T03:46:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114559
- 2026-11-12T03:54:21+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-876/ — Primary: ZDI-26-876 (reported by rgod, published 2026-11-06). ZDI says OriginLab issued an update, links docs.originlab.com/cve/CVE-2026-114559 (page empty to my fetch). Vendor release notes list 10.4.0.25 (2026-07-30) fixing four other CVEs, not this one; fixed version unknown. No exploitation or PoC seen.

## Documents

- [advisory] ZDI-26-876: OriginLab Origin Viewer OGG File Parsing OOB Write RCE https://www.zerodayinitiative.com/advisories/ZDI-26-876/
- [mentions] Origin Viewer Release Notes https://docs.originlab.com/viewer/origin-viewer-release-notes.html

## From the sources

OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30431.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_