---
id: "CVE-2026-114565"
page: "https://infrastack.ai/live/CVE-2026-114565"
kind: "vulnerability"
aliases: ["CVE-2026-114565"]
title: "OriginLab Origin Viewer: crafted OGG file lets attackers run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Origin Viewer", "fixed": [], "affected": "unknown (per ZDI-26-882, Origin Viewer, no version given)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["desktop", "origin-viewer", "originlab", "other", "windows"]
not_affected_if: ["origin-viewer-not-installed"]
published_at: "2026-11-12T03:17:09+00:00"
first_seen_at: "2026-11-12T03:46:12+00:00"
updated_at: "2026-11-12T03:52:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114565", "first_seen_at": "2026-11-12T03:46:12+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-882/", "first_seen_at": "2026-11-12T03:52:02+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-882/", "https://docs.originlab.com/viewer/origin-viewer-release-notes.html"]}]
exploit_sources: []
---

# OriginLab Origin Viewer: crafted OGG file lets attackers run code

Link for people: https://infrastack.ai/live/CVE-2026-114565 (this .md is for agents)

OriginLab Origin Viewer (Windows) has an out-of-bounds write when it parses OGG files. Opening a crafted file, or visiting a page that leads to one, can run code as the user. ZDI rates it CVSS 7.8, local and user-interaction required. OriginLab has issued an update, but the fixed version is not stated in sources I could read.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Origin Viewer affected unknown (per ZDI-26-882, Origin Viewer, no version given) fixed no fixed version listed

## How to check

- Check whether Origin Viewer is installed (Windows installed programs list) and note its version.
- Latest release in the vendor release notes is 10.4.0.25 (2026-07-30), but those notes do not list this CVE. Read the vendor page https://docs.originlab.com/cve/CVE-2026-114565 for the fixed build.
- Treat any machine that opens untrusted .ogg/Origin files in Origin Viewer as in scope until the fixed build is confirmed.

## Fix

OriginLab says an update exists (per ZDI-26-882). Exact fixed version unknown; see the vendor CVE page. Until then, avoid opening untrusted Origin files (OGG) in Origin Viewer.

## Timeline

- 2026-11-12T03:46:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114565
- 2026-11-12T03:52:02+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-882/ — ZDI-26-882 (rgod; reported 2026-05-21, published 2026-11-06) maps to this CVE and says OriginLab issued an update, linking docs.originlab.com/cve/CVE-2026-114565, which returned no content. Release notes list 10.4.0.25 (2026-07-30) as latest but name other CVEs, so the fixed version for this one is unknown. Nothing verified. No exploitation or PoC found. Two sibling ZDI OGG advisories (-881, -876) are separate CVEs.

## Documents

- [advisory] ZDI-26-882 OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write RCE https://www.zerodayinitiative.com/advisories/ZDI-26-882/
- [mentions] Origin Viewer Release Notes https://docs.originlab.com/viewer/origin-viewer-release-notes.html

## From the sources

OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30769.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_