{"id":"CVE-2026-114560","kind":"vulnerability","aliases":["CVE-2026-114560"],"related":[],"title":"OriginLab Origin Viewer: OPJ file parsing flaw lets a file run code","description":"OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30432.","summary":"Origin Viewer, OriginLab's Windows viewer for Origin project files, writes past the end of an allocated data structure when parsing OPJ files. Per ZDI, a user who opens a crafted file or visits a malicious page can have code run in the viewer process. ZDI says OriginLab has issued an update. No exploitation or public PoC is reported.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-parsing","origin-viewer","originlab","other","user-interaction","windows"],"not_affected_if":["never-opens-untrusted-opj-files","no-opj-files","no-origin-viewer"],"how_to_check":"Open Origin Viewer (Windows) > Help > About and read the version. The affected range is not stated by a source I could read. Sibling OPJ CVE-2026-18293 was reported against 9.9.5 and fixed in 10.4.0.25, but this CVE's release notes entry is not confirmed. Check docs.originlab.com/cve/CVE-2026-114560 for the fixed build.","fix":"OriginLab says an update exists (per ZDI-26-877). The fixed version is unknown; install the latest Origin Viewer from originlab.com/viewer and confirm against the vendor CVE page.","status":"open","published_at":"2026-11-12T03:17:08+00:00","first_seen_at":"2026-11-12T03:46:12+00:00","triaged_at":"2026-11-12T03:47:41+00:00","updated_at":"2026-11-12T03:53:15+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T03:47:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"OriginLab Origin Viewer: OPJ file parsing flaw lets a file run code","impact":"high","summary":"Origin Viewer, a scientific data viewer from OriginLab, writes past the end of a buffer when it parses OPJ project files. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the current process.","audience":"businesses","category":"other","nicknames":[],"who_cares":["origin-viewer","originlab","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code in the viewer's process","analyst_note":"Find affected and fixed Origin Viewer versions and a vendor advisory (ZDI-CAN-30432) to fill how_to_check and fix.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-origin-viewer","no-opj-files"],"who_is_affected":"Teams that install OriginLab Origin Viewer and open OPJ files from outside sources are exposed. Sources do not state the affected version range. Teams that do not use Origin Viewer can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":4687,"output_tokens":459,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed Origin Viewer versions and a vendor advisory (ZDI-CAN-30432) to fill how_to_check and fix.","search":"'-114560':15A,18A '-2026':14A,17A '30432':201C 'affect':115C 'alloc':47B,178C 'allow':107C 'arbitrari':112C 'attack':109C,182C 'bound':99C 'code':12A,70B,102C,113C,189C 'context':192C 'craft':61B 'current':195C 'cve':13A,16A 'data':48B,166C,179C 'end':44B,175C 'execut':103C,111C,188C 'exist':146C 'exploit':84B,126C 'file':5A,10A,20B,40B,53B,62B,94C,142C,152C 'file-pars':19B 'flaw':7A,145C 'instal':116C 'interact':29B,122C 'issu':80B,154C 'lack':158C 'let':8A 'leverag':184C 'malici':66B,136C,141C 'must':133C 'open':59B,139C 'opj':4A,52B,93C,151C 'origin':2A,23B,31B,38B,91C,119C 'origin-view':22B 'originlab':1A,25B,33B,78B,90C,118C 'out-of-bound':96C 'page':67B,137C 'pars':6A,21B,51B,95C,149C 'past':42B,173C 'per':54B 'poc':87B 'process':75B,196C 'project':39B 'proper':160C 'public':86B 'remot':101C,108C 'report':89B 'requir':124C 'result':155C,169C 'run':11A,71B 'say':77B 'specif':144C 'structur':49B,180C 'suppli':165C 'target':132C 'updat':82B 'user':28B,57B,121C,164C 'user-interact':27B 'user-suppli':163C 'valid':161C 'viewer':3A,24B,32B,36B,74B,92C,120C 'visit':64B,134C 'vulner':104C,106C,128C,186C 'window':30B,35B 'within':147C 'write':41B,100C,172C 'zdi':55B,76B,199C 'zdi-can':198C","nicknames":[],"mitigations":[],"who_affected":"Teams that install OriginLab Origin Viewer and open OPJ files from outside sources are exposed. Sources do not state the affected version range. Teams that do not use Origin Viewer can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fileparsing","high","originlab","originviewer","other","userinteraction","windows"],"campaign_type":null,"search_a":"'-114560':15A,18A '-2026':14A,17A 'code':12A 'cve':13A,16A 'file':5A,10A 'flaw':7A 'let':8A 'opj':4A 'origin':2A 'originlab':1A 'pars':6A 'run':11A 'viewer':3A","search_b":"'alloc':47B 'code':70B 'craft':61B 'data':48B 'end':44B 'exploit':84B 'file':20B,40B,53B,62B 'file-pars':19B 'interact':29B 'issu':80B 'malici':66B 'open':59B 'opj':52B 'origin':23B,31B,38B 'origin-view':22B 'originlab':25B,33B,78B 'page':67B 'pars':21B,51B 'past':42B 'per':54B 'poc':87B 'process':75B 'project':39B 'public':86B 'report':89B 'run':71B 'say':77B 'structur':49B 'updat':82B 'user':28B,57B 'user-interact':27B 'viewer':24B,32B,36B,74B 'visit':64B 'window':30B,35B 'write':41B 'zdi':55B,76B","search_c":"'30432':201C 'affect':115C 'alloc':178C 'allow':107C 'arbitrari':112C 'attack':109C,182C 'bound':99C 'code':102C,113C,189C 'context':192C 'current':195C 'data':166C,179C 'end':175C 'execut':103C,111C,188C 'exist':146C 'exploit':126C 'file':94C,142C,152C 'flaw':145C 'instal':116C 'interact':122C 'issu':154C 'lack':158C 'leverag':184C 'malici':136C,141C 'must':133C 'open':139C 'opj':93C,151C 'origin':91C,119C 'originlab':90C,118C 'out-of-bound':96C 'page':137C 'pars':95C,149C 'past':173C 'process':196C 'proper':160C 'remot':101C,108C 'requir':124C 'result':155C,169C 'specif':144C 'structur':180C 'suppli':165C 'target':132C 'user':121C,164C 'user-suppli':163C 'valid':161C 'viewer':92C,120C 'visit':134C 'vulner':104C,106C,128C,186C 'within':147C 'write':100C,172C 'zdi':199C 'zdi-can':198C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114560","severity":null,"published_at":"2026-11-12T03:17:08+00:00","modified_at":"2026-11-12T03:17:08+00:00","first_seen_at":"2026-11-12T03:46:12+00:00","fetched_at":"2026-11-12T03:46:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114560:3698","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-877/","severity":null,"published_at":"2026-11-12T03:53:15+00:00","modified_at":"2026-11-12T03:53:15+00:00","first_seen_at":"2026-11-12T03:53:15+00:00","fetched_at":"2026-11-12T03:53:15+00:00","note":"ZDI-26-877 (Nov 6 2026) says OriginLab issued an update and points to docs.originlab.com/cve/CVE-2026-114560, which I could not retrieve. Release notes list 10.4.0.25 (7/30/2026) fixing four sibling CVEs, not this one, so the fixed version is unknown. Nothing verified.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-877/","https://docs.originlab.com/viewer/origin-viewer-release-notes.html"]}],"documents":[{"id":131566,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-877/","title":"ZDI-26-877 OriginLab Origin Viewer OPJ OOB write","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":131543,"url":"https://docs.originlab.com/viewer/origin-viewer-release-notes.html","title":"Origin Viewer Release Notes","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}