---
id: "CVE-2026-114564"
page: "https://infrastack.ai/live/CVE-2026-114564"
kind: "vulnerability"
aliases: ["CVE-2026-114564"]
title: "OriginLab Origin Viewer: OGG file parsing flaw lets a malicious file run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Origin Viewer", "fixed": [], "affected": "unknown versions", "ecosystem": "vendor"}]
ecosystems: []
tags: ["file-parsing", "origin-viewer", "originlab", "package", "user-interaction", "windows"]
not_affected_if: ["no-origin-viewer-installed"]
published_at: "2026-11-12T03:17:09+00:00"
first_seen_at: "2026-11-12T03:46:12+00:00"
updated_at: "2026-11-12T03:51:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114564", "first_seen_at": "2026-11-12T03:46:12+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-881/", "first_seen_at": "2026-11-12T03:51:57+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-881/"]}]
exploit_sources: []
---

# OriginLab Origin Viewer: OGG file parsing flaw lets a malicious file run code

Link for people: https://infrastack.ai/live/CVE-2026-114564 (this .md is for agents)

OriginLab Origin Viewer has an out-of-bounds write when it parses OGG files, a write past the end of an allocated buffer. A remote attacker who gets a user to open a malicious file or visit a malicious page can run arbitrary code in the context of the current process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Origin Viewer affected unknown versions fixed no fixed version listed

## How to check

Open Origin Viewer > Help > About to see the installed version, then compare it with the fixed version on OriginLab's CVE page (docs.originlab.com/cve/CVE-2026-114564, not reachable when checked). No fixed version number was found. Inventory Windows machines that have Origin Viewer installed.

## Fix

OriginLab has issued an update, per ZDI-26-881. The fixed version number is not published in any source I could read. Update Origin Viewer to the latest release from OriginLab and avoid opening OGG or other files from untrusted sources until you have.

## Timeline

- 2026-11-12T03:46:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114564
- 2026-11-12T03:51:57+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-881/ — ZDI-26-881 (rgod, reported 2026-05-21, public 2026-11-06) says OriginLab issued an update, linking docs.originlab.com/cve/CVE-2026-114564, but that page returns 404 and the fixed version is unknown. No exploitation or PoC found. Nothing verified because I found no vendor page.

## Documents

- [advisory] ZDI-26-881 OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write RCE https://www.zerodayinitiative.com/advisories/ZDI-26-881/

## From the sources

OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write  Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30768.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_