{"id":"CVE-2026-114563","kind":"vulnerability","aliases":["CVE-2026-114563"],"related":[],"title":"OriginLab Origin Viewer: OGWU file parsing overflow lets remote code run","description":"OriginLab Origin Viewer OGWU File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30737.","summary":"Origin Viewer, OriginLab's viewer for Origin data files, has a stack-based buffer overflow in OGWU file parsing (length of user data not validated before copying to a stack buffer). ZDI rates it CVSS 7.8 (local, user interaction required): a user must open a malicious file or visit a malicious page. Code runs in the context of the Origin Viewer process. ZDI credits rgod and says OriginLab has issued an update; no exploitation or public PoC found. Anyone with Origin Viewer installed who opens OGWU files from outside sources is exposed; the affected version range is not published. Machines without Origin Viewer can skip it.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Origin Viewer","fixed":[],"affected":"unknown (versions not published)","ecosystem":"vendor"}],"ecosystems":[],"tags":["desktop","file-parsing","origin-viewer","other","user-interaction","windows"],"not_affected_if":["not-installed","origin-viewer-not-installed"],"how_to_check":"Check whether Origin Viewer is installed (Windows Apps & features) and note its version, then compare with the fixed version on OriginLab's CVE page https://docs.originlab.com/cve/CVE-2026-114563 (page returned 404 when read). Until confirmed, avoid opening OGWU files from untrusted sources.","fix":"OriginLab has issued an update (per ZDI-26-880); the fixed version number is unknown, as the vendor page returned 404. Update Origin Viewer to the latest release from OriginLab.","status":"open","published_at":"2026-11-12T03:17:09+00:00","first_seen_at":"2026-11-12T03:46:12+00:00","triaged_at":"2026-11-12T03:47:37+00:00","updated_at":"2026-11-12T03:53:15+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T03:47:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"OriginLab Origin Viewer: OGWU file parsing overflow lets remote code run","impact":"high","summary":"Origin Viewer, OriginLab's data-viewing program, has a stack buffer overflow when it parses OGWU files. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the current process.","audience":"businesses","category":"other","nicknames":[],"who_cares":["origin-viewer","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code in the viewer's process.","analyst_note":"Find affected Origin Viewer versions and the vendor fix in the ZDI advisory (ZDI-CAN-30737) and OriginLab release notes.","how_to_check":"- Check whether Origin Viewer is installed on the machine.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["origin-viewer-not-installed"],"who_is_affected":"Teams that install OriginLab Origin Viewer and open OGWU files, whether from email, downloads or web pages. The sources do not list affected version ranges. Systems without Origin Viewer are not exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000707,"input_tokens":4689,"output_tokens":476,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Origin Viewer versions and the vendor fix in the ZDI advisory (ZDI-CAN-30737) and OriginLab release notes.","search":"'-114563':14A,17A '-2026':13A,16A '30737':248C '7.8':68B 'affect':126B,163C 'allow':155C 'anyon':111B 'arbitrari':160C 'attack':157C,229C 'base':45B,146C,226C 'buffer':46B,63B,147C,227C 'code':10A,85B,150C,161C,236C 'context':89B,239C 'copi':59B,220C 'credit':96B 'current':242C 'cve':12A,15A 'cvss':67B 'data':39B,55B,217C 'desktop':20B 'execut':151C,159C,235C 'exist':194C 'exploit':106B,174C 'expos':124B 'file':5A,22B,40B,50B,79B,119B,142C,190C,200C 'file-pars':21B 'flaw':193C 'found':110B 'instal':115B,164C 'interact':30B,71B,170C 'issu':102B,202C 'lack':206C 'length':52B,212C 'let':8A 'leverag':231C 'local':69B 'machin':132B 'malici':78B,83B,184C,189C 'must':75B,181C 'ogwu':4A,49B,118B,141C,199C 'open':76B,117B,187C 'origin':2A,18A,25B,32B,38B,92B,113B,134B,139C,167C 'origin-view':24B 'originlab':1A,34B,100B,138C,166C 'outsid':121B 'overflow':7A,47B,148C 'page':84B,185C 'pars':6A,23B,51B,143C,197C 'poc':109B 'prior':218C 'process':94B,243C 'proper':208C 'public':108B 'publish':131B 'rang':128B 'rate':65B 'remot':9A,149C,156C 'requir':72B,172C 'result':203C 'rgod':97B 'run':11A,86B 'say':99B 'skip':137B 'sourc':122B 'specif':192C 'stack':44B,62B,145C,225C 'stack-bas':43B,144C,224C 'suppli':216C 'target':180C 'updat':104B 'user':29B,54B,70B,74B,169C,215C 'user-interact':28B 'user-suppli':214C 'valid':57B,209C 'version':127B 'viewer':3A,19A,26B,33B,36B,93B,114B,135B,140C,168C 'visit':81B,182C 'vulner':152C,154C,176C,233C 'window':31B 'within':195C 'without':133B 'zdi':64B,95B,246C 'zdi-can':245C","nicknames":[],"mitigations":[],"who_affected":"Teams that install OriginLab Origin Viewer and open OGWU files, whether from email, downloads or web pages. The sources do not list affected version ranges. Systems without Origin Viewer are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["originviewer","viewer"],"ptokens":["origin","viewer"],"labels":["desktop","fileparsing","high","originviewer","other","userinteraction","windows"],"campaign_type":null,"search_a":"'-114563':14A,17A '-2026':13A,16A 'code':10A 'cve':12A,15A 'file':5A 'let':8A 'ogwu':4A 'origin':2A,18A 'originlab':1A 'overflow':7A 'pars':6A 'remot':9A 'run':11A 'viewer':3A,19A","search_b":"'7.8':68B 'affect':126B 'anyon':111B 'base':45B 'buffer':46B,63B 'code':85B 'context':89B 'copi':59B 'credit':96B 'cvss':67B 'data':39B,55B 'desktop':20B 'exploit':106B 'expos':124B 'file':22B,40B,50B,79B,119B 'file-pars':21B 'found':110B 'instal':115B 'interact':30B,71B 'issu':102B 'length':52B 'local':69B 'machin':132B 'malici':78B,83B 'must':75B 'ogwu':49B,118B 'open':76B,117B 'origin':25B,32B,38B,92B,113B,134B 'origin-view':24B 'originlab':34B,100B 'outsid':121B 'overflow':47B 'page':84B 'pars':23B,51B 'poc':109B 'process':94B 'public':108B 'publish':131B 'rang':128B 'rate':65B 'requir':72B 'rgod':97B 'run':86B 'say':99B 'skip':137B 'sourc':122B 'stack':44B,62B 'stack-bas':43B 'updat':104B 'user':29B,54B,70B,74B 'user-interact':28B 'valid':57B 'version':127B 'viewer':26B,33B,36B,93B,114B,135B 'visit':81B 'window':31B 'without':133B 'zdi':64B,95B","search_c":"'30737':248C 'affect':163C 'allow':155C 'arbitrari':160C 'attack':157C,229C 'base':146C,226C 'buffer':147C,227C 'code':150C,161C,236C 'context':239C 'copi':220C 'current':242C 'data':217C 'execut':151C,159C,235C 'exist':194C 'exploit':174C 'file':142C,190C,200C 'flaw':193C 'instal':164C 'interact':170C 'issu':202C 'lack':206C 'length':212C 'leverag':231C 'malici':184C,189C 'must':181C 'ogwu':141C,199C 'open':187C 'origin':139C,167C 'originlab':138C,166C 'overflow':148C 'page':185C 'pars':143C,197C 'prior':218C 'process':243C 'proper':208C 'remot':149C,156C 'requir':172C 'result':203C 'specif':192C 'stack':145C,225C 'stack-bas':144C,224C 'suppli':216C 'target':180C 'user':169C,215C 'user-suppli':214C 'valid':209C 'viewer':140C,168C 'visit':182C 'vulner':152C,154C,176C,233C 'within':195C 'zdi':246C 'zdi-can':245C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114563","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114563","severity":null,"published_at":"2026-11-12T03:17:09+00:00","modified_at":"2026-11-12T03:17:09+00:00","first_seen_at":"2026-11-12T03:46:12+00:00","fetched_at":"2026-11-12T03:46:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114563:3695","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-880/","severity":null,"published_at":"2026-11-12T03:53:15+00:00","modified_at":"2026-11-12T03:53:15+00:00","first_seen_at":"2026-11-12T03:53:15+00:00","fetched_at":"2026-11-12T03:53:15+00:00","note":"ZDI-26-880 read; says vendor update exists, vendor CVE page 404, so versions unknown. Nothing marked verified. Siblings CVE-2026-114562/114567/114569 are separate OGWU bugs. No exploitation seen.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-880/"]}],"documents":[{"id":131565,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-880/","title":"ZDI-26-880: OriginLab Origin Viewer OGWU File Parsing Stack-based Buffer Overflow RCE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}