---
id: "CVE-2026-114560"
page: "https://infrastack.ai/live/CVE-2026-114560"
kind: "vulnerability"
aliases: ["CVE-2026-114560"]
title: "OriginLab Origin Viewer: OPJ file parsing flaw lets a file run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["file-parsing", "origin-viewer", "originlab", "other", "user-interaction", "windows"]
not_affected_if: ["never-opens-untrusted-opj-files", "no-opj-files", "no-origin-viewer"]
published_at: "2026-11-12T03:17:08+00:00"
first_seen_at: "2026-11-12T03:46:12+00:00"
updated_at: "2026-11-12T03:53:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114560", "first_seen_at": "2026-11-12T03:46:12+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-877/", "first_seen_at": "2026-11-12T03:53:15+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-877/", "https://docs.originlab.com/viewer/origin-viewer-release-notes.html"]}]
exploit_sources: []
---

# OriginLab Origin Viewer: OPJ file parsing flaw lets a file run code

Link for people: https://infrastack.ai/live/CVE-2026-114560 (this .md is for agents)

Origin Viewer, OriginLab's Windows viewer for Origin project files, writes past the end of an allocated data structure when parsing OPJ files. Per ZDI, a user who opens a crafted file or visits a malicious page can have code run in the viewer process. ZDI says OriginLab has issued an update. No exploitation or public PoC is reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Open Origin Viewer (Windows) > Help > About and read the version. The affected range is not stated by a source I could read. Sibling OPJ CVE-2026-18293 was reported against 9.9.5 and fixed in 10.4.0.25, but this CVE's release notes entry is not confirmed. Check docs.originlab.com/cve/CVE-2026-114560 for the fixed build.

## Fix

OriginLab says an update exists (per ZDI-26-877). The fixed version is unknown; install the latest Origin Viewer from originlab.com/viewer and confirm against the vendor CVE page.

## Timeline

- 2026-11-12T03:46:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114560
- 2026-11-12T03:53:15+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-877/ — ZDI-26-877 (Nov 6 2026) says OriginLab issued an update and points to docs.originlab.com/cve/CVE-2026-114560, which I could not retrieve. Release notes list 10.4.0.25 (7/30/2026) fixing four sibling CVEs, not this one, so the fixed version is unknown. Nothing verified.

## Documents

- [advisory] ZDI-26-877 OriginLab Origin Viewer OPJ OOB write https://www.zerodayinitiative.com/advisories/ZDI-26-877/
- [mentions] Origin Viewer Release Notes https://docs.originlab.com/viewer/origin-viewer-release-notes.html

## From the sources

OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30432.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_