---
id: "CVE-2026-114561"
page: "https://infrastack.ai/live/CVE-2026-114561"
kind: "vulnerability"
aliases: ["CVE-2026-114561"]
title: "OriginLab Origin Viewer: crafted OPJU file lets attackers run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "OriginLab Origin Viewer", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["desktop", "opju", "origin-viewer", "originlab", "other", "windows"]
not_affected_if: ["no-opju-files", "no-origin-viewer"]
published_at: "2026-11-12T03:17:08+00:00"
first_seen_at: "2026-11-12T03:46:12+00:00"
updated_at: "2026-11-12T03:53:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114561", "first_seen_at": "2026-11-12T03:46:12+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-878/", "first_seen_at": "2026-11-12T03:53:03+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-878/", "https://docs.originlab.com/viewer/origin-viewer-release-notes.html"]}]
exploit_sources: []
---

# OriginLab Origin Viewer: crafted OPJU file lets attackers run code

Link for people: https://infrastack.ai/live/CVE-2026-114561 (this .md is for agents)

OriginLab Origin Viewer has an out-of-bounds write when it parses OPJU files. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the current process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:OriginLab Origin Viewer affected range not listed fixed no fixed version listed

## How to check

Open Origin Viewer, Help > About, and note the version. Compare it with the latest build on docs.originlab.com/viewer/origin-viewer-release-notes.html. Affected versions are unknown (ZDI says only 'Origin Viewer'). Also check whether anyone on your team opens .opju files from outside sources.

## Fix

ZDI says OriginLab has issued an update, but the exact fixed version is not published in the sources I could read. Install the latest Origin Viewer from OriginLab (the release notes list 10.4.0.25, 7/30/2026, as the latest build; it does not name this CVE).

## Timeline

- 2026-11-12T03:46:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114561
- 2026-11-12T03:53:03+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-878/ — ZDI-26-878 (published 2026-11-06, reported to vendor 2026-05-21) says OriginLab issued an update. The vendor page docs.originlab.com/cve/CVE-2026-114561 returned 404 and the release notes do not name this CVE, so no versions are verified. No PoC or exploitation seen. X and community search not run. Note: ZDI-26-886 / CVE-2026-114558 is a sibling with identical text; they may be separate bugs.

## Documents

- [advisory] ZDI-26-878 OriginLab Origin Viewer OPJU OOB write (ZDI-CAN-30433) https://www.zerodayinitiative.com/advisories/ZDI-26-878/
- [mentions] Origin Viewer Release Notes https://docs.originlab.com/viewer/origin-viewer-release-notes.html

## From the sources

OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30433.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_