{"id":"CVE-2026-114564","kind":"vulnerability","aliases":["CVE-2026-114564"],"related":[],"title":"OriginLab Origin Viewer: OGG file parsing flaw lets a malicious file run code","description":"OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write  Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30768.","summary":"OriginLab Origin Viewer has an out-of-bounds write when it parses OGG files, a write past the end of an allocated buffer. A remote attacker who gets a user to open a malicious file or visit a malicious page can run arbitrary code in the context of the current process.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Origin Viewer","fixed":[],"affected":"unknown versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["file-parsing","origin-viewer","originlab","package","user-interaction","windows"],"not_affected_if":["no-origin-viewer-installed"],"how_to_check":"Open Origin Viewer > Help > About to see the installed version, then compare it with the fixed version on OriginLab's CVE page (docs.originlab.com/cve/CVE-2026-114564, not reachable when checked). No fixed version number was found. Inventory Windows machines that have Origin Viewer installed.","fix":"OriginLab has issued an update, per ZDI-26-881. The fixed version number is not published in any source I could read. Update Origin Viewer to the latest release from OriginLab and avoid opening OGG or other files from untrusted sources until you have.","status":"open","published_at":"2026-11-12T03:17:09+00:00","first_seen_at":"2026-11-12T03:46:12+00:00","triaged_at":"2026-11-12T03:47:37+00:00","updated_at":"2026-11-12T03:51:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T03:47:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OriginLab Origin Viewer: OGG file parsing flaw lets a malicious file run code","impact":"high","summary":"OriginLab Origin Viewer has an out-of-bounds write when it parses OGG files, a write past the end of an allocated buffer. A remote attacker who gets a user to open a malicious file or visit a malicious page can run arbitrary code in the context of the current process.","audience":"businesses","category":"package","nicknames":[],"who_cares":["originlab","origin-viewer","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs arbitrary code in the viewer's process","analyst_note":"Find affected Origin Viewer versions and the vendor fix at the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-114564) and the ZDI advisory for ZDI-CAN-30768.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-origin-viewer-installed"],"who_is_affected":"Teams that install OriginLab Origin Viewer and open OGG files from outside sources are exposed, since the flaw is triggered by a crafted file or page the user opens. The sources do not name affected versions or a vendor fix.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4685,"output_tokens":504,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Origin Viewer versions and the vendor fix at the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-114564) and the ZDI advisory for ZDI-CAN-30768.","search":"'-114564':16A,19A '-2026':15A,18A '30768':197C 'affect':111C 'alloc':56B,174C 'allow':103C 'arbitrari':77B,108C 'attack':60B,105C,178C 'bound':42B,95C 'buffer':57B 'code':13A,78B,98C,109C,185C 'context':81B,188C 'current':84B,191C 'cve':14A,17A 'data':162C,175C 'end':53B,171C 'execut':99C,107C,184C 'exist':142C 'exploit':122C 'file':5A,11A,23B,48B,69B,90C,138C,148C 'file-pars':22B 'flaw':7A,141C 'get':62B 'instal':112C 'interact':32B,118C 'issu':150C 'lack':154C 'let':8A 'leverag':180C 'malici':10A,68B,73B,132C,137C 'must':129C 'ogg':4A,47B,89C,147C 'open':66B,135C 'origin':2A,20A,26B,35B,87C,115C 'origin-view':25B 'originlab':1A,28B,34B,86C,114C 'out-of-bound':39B,92C 'packag':29B 'page':74B,133C 'pars':6A,24B,46B,91C,145C 'past':51B,169C 'process':85B,192C 'proper':156C 'remot':59B,97C,104C 'requir':120C 'result':151C,165C 'run':12A,76B 'specif':140C 'structur':176C 'suppli':161C 'target':128C 'user':31B,64B,117C,160C 'user-interact':30B 'user-suppli':159C 'valid':157C 'viewer':3A,21A,27B,36B,88C,116C 'visit':71B,130C 'vulner':100C,102C,124C,182C 'window':33B 'within':143C 'write':43B,50B,96C,168C 'zdi':195C 'zdi-can':194C","nicknames":[],"mitigations":[],"who_affected":"Teams that install OriginLab Origin Viewer and open OGG files from outside sources are exposed, since the flaw is triggered by a crafted file or page the user opens. The sources do not name affected versions or a vendor fix.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["originviewer","viewer"],"ptokens":["origin","viewer"],"labels":["fileparsing","high","originlab","originviewer","package","userinteraction","windows"],"campaign_type":null,"search_a":"'-114564':16A,19A '-2026':15A,18A 'code':13A 'cve':14A,17A 'file':5A,11A 'flaw':7A 'let':8A 'malici':10A 'ogg':4A 'origin':2A,20A 'originlab':1A 'pars':6A 'run':12A 'viewer':3A,21A","search_b":"'alloc':56B 'arbitrari':77B 'attack':60B 'bound':42B 'buffer':57B 'code':78B 'context':81B 'current':84B 'end':53B 'file':23B,48B,69B 'file-pars':22B 'get':62B 'interact':32B 'malici':68B,73B 'ogg':47B 'open':66B 'origin':26B,35B 'origin-view':25B 'originlab':28B,34B 'out-of-bound':39B 'packag':29B 'page':74B 'pars':24B,46B 'past':51B 'process':85B 'remot':59B 'run':76B 'user':31B,64B 'user-interact':30B 'viewer':27B,36B 'visit':71B 'window':33B 'write':43B,50B","search_c":"'30768':197C 'affect':111C 'alloc':174C 'allow':103C 'arbitrari':108C 'attack':105C,178C 'bound':95C 'code':98C,109C,185C 'context':188C 'current':191C 'data':162C,175C 'end':171C 'execut':99C,107C,184C 'exist':142C 'exploit':122C 'file':90C,138C,148C 'flaw':141C 'instal':112C 'interact':118C 'issu':150C 'lack':154C 'leverag':180C 'malici':132C,137C 'must':129C 'ogg':89C,147C 'open':135C 'origin':87C,115C 'originlab':86C,114C 'out-of-bound':92C 'page':133C 'pars':91C,145C 'past':169C 'process':192C 'proper':156C 'remot':97C,104C 'requir':120C 'result':151C,165C 'specif':140C 'structur':176C 'suppli':161C 'target':128C 'user':117C,160C 'user-suppli':159C 'valid':157C 'viewer':88C,116C 'visit':130C 'vulner':100C,102C,124C,182C 'within':143C 'write':96C,168C 'zdi':195C 'zdi-can':194C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114564","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114564","severity":null,"published_at":"2026-11-12T03:17:09+00:00","modified_at":"2026-11-12T03:17:09+00:00","first_seen_at":"2026-11-12T03:46:12+00:00","fetched_at":"2026-11-12T03:46:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114564:3694","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-881/","severity":null,"published_at":"2026-11-12T03:51:57+00:00","modified_at":"2026-11-12T03:51:57+00:00","first_seen_at":"2026-11-12T03:51:57+00:00","fetched_at":"2026-11-12T03:51:57+00:00","note":"ZDI-26-881 (rgod, reported 2026-05-21, public 2026-11-06) says OriginLab issued an update, linking docs.originlab.com/cve/CVE-2026-114564, but that page returns 404 and the fixed version is unknown. No exploitation or PoC found. Nothing verified because I found no vendor page.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-881/"]}],"documents":[{"id":131553,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-881/","title":"ZDI-26-881 OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write RCE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}