{"id":"CVE-2026-114565","kind":"vulnerability","aliases":["CVE-2026-114565"],"related":[],"title":"OriginLab Origin Viewer: crafted OGG file lets attackers run code","description":"OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30769.","summary":"OriginLab Origin Viewer (Windows) has an out-of-bounds write when it parses OGG files. Opening a crafted file, or visiting a page that leads to one, can run code as the user. ZDI rates it CVSS 7.8, local and user-interaction required. OriginLab has issued an update, but the fixed version is not stated in sources I could read.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Origin Viewer","fixed":[],"affected":"unknown (per ZDI-26-882, Origin Viewer, no version given)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["desktop","origin-viewer","originlab","other","windows"],"not_affected_if":["origin-viewer-not-installed"],"how_to_check":"- Check whether Origin Viewer is installed (Windows installed programs list) and note its version.\n- Latest release in the vendor release notes is 10.4.0.25 (2026-07-30), but those notes do not list this CVE. Read the vendor page https://docs.originlab.com/cve/CVE-2026-114565 for the fixed build.\n- Treat any machine that opens untrusted .ogg/Origin files in Origin Viewer as in scope until the fixed build is confirmed.","fix":"OriginLab says an update exists (per ZDI-26-882). Exact fixed version unknown; see the vendor CVE page. Until then, avoid opening untrusted Origin files (OGG) in Origin Viewer.","status":"open","published_at":"2026-11-12T03:17:09+00:00","first_seen_at":"2026-11-12T03:46:12+00:00","triaged_at":"2026-11-12T03:47:37+00:00","updated_at":"2026-11-12T03:52:02+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T03:47:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"OriginLab Origin Viewer: crafted OGG file lets attackers run code","impact":"high","summary":"OriginLab Origin Viewer has an out-of-bounds write when it parses OGG files, a flaw in how it validates the data it reads. An attacker who gets a user to open a malicious file or visit a malicious page can execute code in the context of the current process.","audience":"businesses","category":"other","nicknames":[],"who_cares":["originlab","origin-viewer","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"code runs in the viewer's process after a user opens a file","analyst_note":"Find the affected version range and fixed version in the OriginLab or ZDI advisory (ZDI-CAN-30769); the NVD entry gives none.","how_to_check":"- Check whether Origin Viewer is installed on the machine, from the installed programs list\n- Compare the installed version against the fixed version in the vendor advisory: unknown","plain_action":"","product_name":"Origin Viewer","needs_analyst":true,"not_affected_if":["origin-viewer-not-installed"],"who_is_affected":"Machines with OriginLab Origin Viewer installed are exposed when a user opens a crafted OGG file or visits a malicious page. The sources do not list affected version ranges. Teams that do not use Origin Viewer can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4684,"output_tokens":543,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected version range and fixed version in the OriginLab or ZDI advisory (ZDI-CAN-30769); the NVD entry gives none.","search":"'-114565':13A,16A '-2026':12A,15A '30769':199C '7.8':64B 'affect':113C 'alloc':176C 'allow':105C 'arbitrari':110C 'attack':8A,107C,180C 'bound':35B,97C 'code':10A,56B,100C,111C,187C 'context':190C 'could':86B 'craft':4A,44B 'current':193C 'cve':11A,14A 'cvss':63B 'data':164C,177C 'desktop':19B 'end':173C 'execut':101C,109C,186C 'exist':144C 'exploit':124C 'file':6A,41B,45B,92C,140C,150C 'fix':78B 'flaw':143C 'instal':114C 'interact':69B,120C 'issu':73B,152C 'lack':156C 'lead':51B 'let':7A 'leverag':182C 'local':65B 'malici':134C,139C 'must':131C 'ogg':5A,40B,91C,149C 'one':53B 'open':42B,137C 'origin':2A,17A,21B,27B,89C,117C 'origin-view':20B 'originlab':1A,23B,26B,71B,88C,116C 'out-of-bound':32B,94C 'page':49B,135C 'pars':39B,93C,147C 'past':171C 'process':194C 'proper':158C 'rate':61B 'read':87B 'remot':99C,106C 'requir':70B,122C 'result':153C,167C 'run':9A,55B 'sourc':84B 'specif':142C 'state':82B 'structur':178C 'suppli':163C 'target':130C 'updat':75B 'user':59B,68B,119C,162C 'user-interact':67B 'user-suppli':161C 'valid':159C 'version':79B 'viewer':3A,18A,22B,28B,90C,118C 'visit':47B,132C 'vulner':102C,104C,126C,184C 'window':25B,29B 'within':145C 'write':36B,98C,170C 'zdi':60B,197C 'zdi-can':196C","nicknames":[],"mitigations":[],"who_affected":"Anyone running OriginLab Origin Viewer on Windows who opens Origin graph files (OGG) from outside sources. An attacker needs the user to open a malicious file or visit a malicious page. Teams that do not install Origin Viewer can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["originviewer","viewer"],"ptokens":["origin","viewer"],"labels":["desktop","high","originlab","originviewer","other","vendor","windows"],"campaign_type":null,"search_a":"'-114565':13A,16A '-2026':12A,15A 'attack':8A 'code':10A 'craft':4A 'cve':11A,14A 'file':6A 'let':7A 'ogg':5A 'origin':2A,17A 'originlab':1A 'run':9A 'viewer':3A,18A","search_b":"'7.8':64B 'bound':35B 'code':56B 'could':86B 'craft':44B 'cvss':63B 'desktop':19B 'file':41B,45B 'fix':78B 'interact':69B 'issu':73B 'lead':51B 'local':65B 'ogg':40B 'one':53B 'open':42B 'origin':21B,27B 'origin-view':20B 'originlab':23B,26B,71B 'out-of-bound':32B 'page':49B 'pars':39B 'rate':61B 'read':87B 'requir':70B 'run':55B 'sourc':84B 'state':82B 'updat':75B 'user':59B,68B 'user-interact':67B 'version':79B 'viewer':22B,28B 'visit':47B 'window':25B,29B 'write':36B 'zdi':60B","search_c":"'30769':199C 'affect':113C 'alloc':176C 'allow':105C 'arbitrari':110C 'attack':107C,180C 'bound':97C 'code':100C,111C,187C 'context':190C 'current':193C 'data':164C,177C 'end':173C 'execut':101C,109C,186C 'exist':144C 'exploit':124C 'file':92C,140C,150C 'flaw':143C 'instal':114C 'interact':120C 'issu':152C 'lack':156C 'leverag':182C 'malici':134C,139C 'must':131C 'ogg':91C,149C 'open':137C 'origin':89C,117C 'originlab':88C,116C 'out-of-bound':94C 'page':135C 'pars':93C,147C 'past':171C 'process':194C 'proper':158C 'remot':99C,106C 'requir':122C 'result':153C,167C 'specif':142C 'structur':178C 'suppli':163C 'target':130C 'user':119C,162C 'user-suppli':161C 'valid':159C 'viewer':90C,118C 'visit':132C 'vulner':102C,104C,126C,184C 'within':145C 'write':98C,170C 'zdi':197C 'zdi-can':196C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114565","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114565","severity":null,"published_at":"2026-11-12T03:17:09+00:00","modified_at":"2026-11-12T03:17:09+00:00","first_seen_at":"2026-11-12T03:46:12+00:00","fetched_at":"2026-11-12T03:46:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114565:3693","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-882/","severity":null,"published_at":"2026-11-12T03:52:02+00:00","modified_at":"2026-11-12T03:52:02+00:00","first_seen_at":"2026-11-12T03:52:02+00:00","fetched_at":"2026-11-12T03:52:02+00:00","note":"ZDI-26-882 (rgod; reported 2026-05-21, published 2026-11-06) maps to this CVE and says OriginLab issued an update, linking docs.originlab.com/cve/CVE-2026-114565, which returned no content. Release notes list 10.4.0.25 (2026-07-30) as latest but name other CVEs, so the fixed version for this one is unknown. Nothing verified. No exploitation or PoC found. Two sibling ZDI OGG advisories (-881, -876) are separate CVEs.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-882/","https://docs.originlab.com/viewer/origin-viewer-release-notes.html"]}],"documents":[{"id":131549,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-882/","title":"ZDI-26-882 OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write RCE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":131543,"url":"https://docs.originlab.com/viewer/origin-viewer-release-notes.html","title":"Origin Viewer Release Notes","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}