{"id":"CVE-2026-114561","kind":"vulnerability","aliases":["CVE-2026-114561"],"related":[],"title":"OriginLab Origin Viewer: crafted OPJU file lets attackers run code","description":"OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30433.","summary":"OriginLab Origin Viewer has an out-of-bounds write when it parses OPJU files. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the current process.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OriginLab Origin Viewer","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["desktop","opju","origin-viewer","originlab","other","windows"],"not_affected_if":["no-opju-files","no-origin-viewer"],"how_to_check":"Open Origin Viewer, Help > About, and note the version. Compare it with the latest build on docs.originlab.com/viewer/origin-viewer-release-notes.html. Affected versions are unknown (ZDI says only 'Origin Viewer'). Also check whether anyone on your team opens .opju files from outside sources.","fix":"ZDI says OriginLab has issued an update, but the exact fixed version is not published in the sources I could read. Install the latest Origin Viewer from OriginLab (the release notes list 10.4.0.25, 7/30/2026, as the latest build; it does not name this CVE).","status":"open","published_at":"2026-11-12T03:17:08+00:00","first_seen_at":"2026-11-12T03:46:12+00:00","triaged_at":"2026-11-12T03:47:40+00:00","updated_at":"2026-11-12T03:53:03+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T03:47:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"OriginLab Origin Viewer: crafted OPJU file lets attackers run code","impact":"high","summary":"OriginLab Origin Viewer has an out-of-bounds write when it parses OPJU files. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the current process.","audience":"businesses","category":"other","nicknames":[],"who_cares":["origin-viewer","originlab","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs in the viewer process after a malicious file opens","analyst_note":"Find affected and fixed Origin Viewer versions and any vendor advisory; check the ZDI advisory (ZDI-CAN-30433) for details.","how_to_check":"- unknown","plain_action":"","product_name":"OriginLab Origin Viewer","needs_analyst":true,"not_affected_if":["no-origin-viewer","no-opju-files"],"who_is_affected":"Teams that run OriginLab Origin Viewer and open OPJU files from outside sources are exposed, since user interaction is required. The sources do not list affected versions. Teams that do not use Origin Viewer can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4687,"output_tokens":485,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed Origin Viewer versions and any vendor advisory; check the ZDI advisory (ZDI-CAN-30433) for details.","search":"'-114561':13A,16A '-2026':12A,15A '30433':180C 'affect':94C 'alloc':157C 'allow':86C 'arbitrari':91C 'attack':8A,44B,88C,161C 'bound':36B,78C 'code':10A,61B,81C,92C,168C 'context':64B,171C 'craft':4A 'current':67B,174C 'cve':11A,14A 'data':145C,158C 'desktop':20B 'end':154C 'execut':82C,90C,167C 'exist':125C 'exploit':105C 'file':6A,42B,53B,73C,121C,131C 'flaw':124C 'get':46B 'instal':95C 'interact':101C 'issu':133C 'lack':137C 'let':7A 'leverag':163C 'malici':52B,57B,115C,120C 'must':112C 'open':50B,118C 'opju':5A,21B,41B,72C,130C 'origin':2A,18A,23B,29B,70C,98C 'origin-view':22B 'originlab':1A,17A,25B,28B,69C,97C 'out-of-bound':33B,75C 'page':58B,116C 'pars':40B,74C,128C 'past':152C 'process':68B,175C 'proper':139C 'remot':80C,87C 'requir':103C 'result':134C,148C 'run':9A,60B 'specif':123C 'structur':159C 'suppli':144C 'target':111C 'user':48B,100C,143C 'user-suppli':142C 'valid':140C 'viewer':3A,19A,24B,30B,71C,99C 'visit':55B,113C 'vulner':83C,85C,107C,165C 'window':27B 'within':126C 'write':37B,79C,151C 'zdi':178C 'zdi-can':177C","nicknames":[],"mitigations":[],"who_affected":"Windows users of OriginLab Origin Viewer who open OPJU project files from outside sources are exposed: a crafted file, or a page that leads to opening one, can run code as the viewer process. User interaction is required. Affected versions are not published. Teams that don't have Origin Viewer installed, or that only open trusted files, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["originlaboriginviewer","originviewer"],"ptokens":["origin","originlab","viewer"],"labels":["desktop","high","opju","originlab","originviewer","other","vendor","windows"],"campaign_type":null,"search_a":"'-114561':13A,16A '-2026':12A,15A 'attack':8A 'code':10A 'craft':4A 'cve':11A,14A 'file':6A 'let':7A 'opju':5A 'origin':2A,18A 'originlab':1A,17A 'run':9A 'viewer':3A,19A","search_b":"'attack':44B 'bound':36B 'code':61B 'context':64B 'current':67B 'desktop':20B 'file':42B,53B 'get':46B 'malici':52B,57B 'open':50B 'opju':21B,41B 'origin':23B,29B 'origin-view':22B 'originlab':25B,28B 'out-of-bound':33B 'page':58B 'pars':40B 'process':68B 'run':60B 'user':48B 'viewer':24B,30B 'visit':55B 'window':27B 'write':37B","search_c":"'30433':180C 'affect':94C 'alloc':157C 'allow':86C 'arbitrari':91C 'attack':88C,161C 'bound':78C 'code':81C,92C,168C 'context':171C 'current':174C 'data':145C,158C 'end':154C 'execut':82C,90C,167C 'exist':125C 'exploit':105C 'file':73C,121C,131C 'flaw':124C 'instal':95C 'interact':101C 'issu':133C 'lack':137C 'leverag':163C 'malici':115C,120C 'must':112C 'open':118C 'opju':72C,130C 'origin':70C,98C 'originlab':69C,97C 'out-of-bound':75C 'page':116C 'pars':74C,128C 'past':152C 'process':175C 'proper':139C 'remot':80C,87C 'requir':103C 'result':134C,148C 'specif':123C 'structur':159C 'suppli':144C 'target':111C 'user':100C,143C 'user-suppli':142C 'valid':140C 'viewer':71C,99C 'visit':113C 'vulner':83C,85C,107C,165C 'within':126C 'write':79C,151C 'zdi':178C 'zdi-can':177C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114561","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114561","severity":null,"published_at":"2026-11-12T03:17:08+00:00","modified_at":"2026-11-12T03:17:08+00:00","first_seen_at":"2026-11-12T03:46:12+00:00","fetched_at":"2026-11-12T03:46:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114561:3697","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-878/","severity":null,"published_at":"2026-11-12T03:53:03+00:00","modified_at":"2026-11-12T03:53:03+00:00","first_seen_at":"2026-11-12T03:53:03+00:00","fetched_at":"2026-11-12T03:53:03+00:00","note":"ZDI-26-878 (published 2026-11-06, reported to vendor 2026-05-21) says OriginLab issued an update. The vendor page docs.originlab.com/cve/CVE-2026-114561 returned 404 and the release notes do not name this CVE, so no versions are verified. No PoC or exploitation seen. X and community search not run. Note: ZDI-26-886 / CVE-2026-114558 is a sibling with identical text; they may be separate bugs.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-878/","https://docs.originlab.com/viewer/origin-viewer-release-notes.html"]}],"documents":[{"id":131561,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-878/","title":"ZDI-26-878 OriginLab Origin Viewer OPJU OOB write (ZDI-CAN-30433)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":131543,"url":"https://docs.originlab.com/viewer/origin-viewer-release-notes.html","title":"Origin Viewer Release Notes","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}