---
id: "CVE-2026-114563"
page: "https://infrastack.ai/live/CVE-2026-114563"
kind: "vulnerability"
aliases: ["CVE-2026-114563"]
title: "OriginLab Origin Viewer: OGWU file parsing overflow lets remote code run"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Origin Viewer", "fixed": [], "affected": "unknown (versions not published)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["desktop", "file-parsing", "origin-viewer", "other", "user-interaction", "windows"]
not_affected_if: ["not-installed", "origin-viewer-not-installed"]
published_at: "2026-11-12T03:17:09+00:00"
first_seen_at: "2026-11-12T03:46:12+00:00"
updated_at: "2026-11-12T03:53:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114563", "first_seen_at": "2026-11-12T03:46:12+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-880/", "first_seen_at": "2026-11-12T03:53:15+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-880/"]}]
exploit_sources: []
---

# OriginLab Origin Viewer: OGWU file parsing overflow lets remote code run

Link for people: https://infrastack.ai/live/CVE-2026-114563 (this .md is for agents)

Origin Viewer, OriginLab's viewer for Origin data files, has a stack-based buffer overflow in OGWU file parsing (length of user data not validated before copying to a stack buffer). ZDI rates it CVSS 7.8 (local, user interaction required): a user must open a malicious file or visit a malicious page. Code runs in the context of the Origin Viewer process. ZDI credits rgod and says OriginLab has issued an update; no exploitation or public PoC found. Anyone with Origin Viewer installed who opens OGWU files from outside sources is exposed; the affected version range is not published. Machines without Origin Viewer can skip it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Origin Viewer affected unknown (versions not published) fixed no fixed version listed

## How to check

Check whether Origin Viewer is installed (Windows Apps & features) and note its version, then compare with the fixed version on OriginLab's CVE page https://docs.originlab.com/cve/CVE-2026-114563 (page returned 404 when read). Until confirmed, avoid opening OGWU files from untrusted sources.

## Fix

OriginLab has issued an update (per ZDI-26-880); the fixed version number is unknown, as the vendor page returned 404. Update Origin Viewer to the latest release from OriginLab.

## Timeline

- 2026-11-12T03:46:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114563
- 2026-11-12T03:53:15+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-880/ — ZDI-26-880 read; says vendor update exists, vendor CVE page 404, so versions unknown. Nothing marked verified. Siblings CVE-2026-114562/114567/114569 are separate OGWU bugs. No exploitation seen.

## Documents

- [advisory] ZDI-26-880: OriginLab Origin Viewer OGWU File Parsing Stack-based Buffer Overflow RCE https://www.zerodayinitiative.com/advisories/ZDI-26-880/

## From the sources

OriginLab Origin Viewer OGWU File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30737.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_