{"id":"CVE-2026-114566","kind":"vulnerability","aliases":["CVE-2026-114566"],"related":[],"title":"OriginLab Origin Viewer: crafted OGM file can run code on open","description":"OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30770.","summary":"OriginLab Origin Viewer has a memory corruption flaw when it parses OGM files without validating the data. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the current process.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Origin Viewer","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["desktop","origin-viewer","originlab","other","windows"],"not_affected_if":["no-origin-viewer","no-untrusted-ogm-files"],"how_to_check":"Open Origin Viewer > Help > About and read the version; Origin Viewer is a Windows app. The fixed version for this CVE is not confirmed (see OriginLab's page docs.originlab.com/cve/CVE-2026-114566). Sibling OriginLab/ZDI fixes (other CVEs, e.g. ZDI-26-586) landed in 10.4.0.25, so also check whether you are older than 10.4.0.25 and update to the latest Origin Viewer.","fix":"ZDI-26-883 says OriginLab has issued an update; the exact fixed version is not stated on the ZDI page, and OriginLab's page (docs.originlab.com/cve/CVE-2026-114566) could not be read. Install the latest Origin Viewer from OriginLab (at least 10.4.0.25, the latest in the release notes I could read). Until then do not open OGM files from untrusted sources.","status":"open","published_at":"2026-11-12T03:17:09+00:00","first_seen_at":"2026-11-12T03:46:12+00:00","triaged_at":"2026-11-12T03:47:34+00:00","updated_at":"2026-11-12T03:51:56+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T03:47:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OriginLab Origin Viewer: crafted OGM file can run code on open","impact":"high","summary":"OriginLab Origin Viewer has a memory corruption flaw when it parses OGM files without validating the data. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the current process.","audience":"businesses","category":"other","nicknames":[],"who_cares":["originlab","origin-viewer","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code in the viewer's process context","analyst_note":"Confirm affected Origin Viewer versions and fixed release from the OriginLab advisory or ZDI-CAN-30770 page; sources give neither.","how_to_check":"unknown","plain_action":"","product_name":"Origin Viewer","needs_analyst":true,"not_affected_if":["no-origin-viewer","no-untrusted-ogm-files"],"who_is_affected":"Anyone running OriginLab Origin Viewer who opens OGM files from untrusted sources or visits untrusted pages. The sources do not list affected versions or configuration details.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4669,"output_tokens":474,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Origin Viewer versions and fixed release from the OriginLab advisory or ZDI-CAN-30770 page; sources give neither.","search":"'-114566':14A,17A '-2026':13A,16A '30770':172C 'affect':92C 'allow':84C 'arbitrari':89C 'attack':45B,86C,153C 'code':9A,62B,79C,90C,160C 'condit':151C 'context':65B,163C 'corrupt':33B,77C,150C 'craft':4A 'current':68B,166C 'cve':12A,15A 'data':43B,143C 'desktop':20B 'execut':80C,88C,159C 'exist':123C 'exploit':103C 'file':6A,39B,54B,74C,119C,129C 'flaw':34B,122C 'get':47B 'instal':93C 'interact':99C 'issu':131C 'lack':135C 'leverag':155C 'malici':53B,58B,113C,118C 'memori':32B,76C,149C 'must':110C 'ogm':5A,38B,73C,128C 'open':11A,51B,116C 'origin':2A,18A,22B,28B,71C,96C 'origin-view':21B 'originlab':1A,24B,27B,70C,95C 'page':59B,114C 'pars':37B,75C,126C 'process':69B,167C 'proper':137C 'remot':78C,85C 'requir':101C 'result':132C,146C 'run':8A,61B 'specif':121C 'suppli':142C 'target':109C 'user':49B,98C,141C 'user-suppli':140C 'valid':41B,138C 'viewer':3A,19A,23B,29B,72C,97C 'visit':56B,111C 'vulner':81C,83C,105C,157C 'window':26B 'within':124C 'without':40B 'zdi':170C 'zdi-can':169C","nicknames":[],"mitigations":[],"who_affected":"Anyone running OriginLab Origin Viewer (a Windows app) who opens OGM files from untrusted sources or is lured to a malicious page that opens one. Attack needs user interaction and runs code as the user. Affected version range is not published on the sources I could read. Teams without Origin Viewer can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["originviewer","viewer"],"ptokens":["origin","viewer"],"labels":["desktop","high","originlab","originviewer","other","vendor","windows"],"campaign_type":null,"search_a":"'-114566':14A,17A '-2026':13A,16A 'code':9A 'craft':4A 'cve':12A,15A 'file':6A 'ogm':5A 'open':11A 'origin':2A,18A 'originlab':1A 'run':8A 'viewer':3A,19A","search_b":"'attack':45B 'code':62B 'context':65B 'corrupt':33B 'current':68B 'data':43B 'desktop':20B 'file':39B,54B 'flaw':34B 'get':47B 'malici':53B,58B 'memori':32B 'ogm':38B 'open':51B 'origin':22B,28B 'origin-view':21B 'originlab':24B,27B 'page':59B 'pars':37B 'process':69B 'run':61B 'user':49B 'valid':41B 'viewer':23B,29B 'visit':56B 'window':26B 'without':40B","search_c":"'30770':172C 'affect':92C 'allow':84C 'arbitrari':89C 'attack':86C,153C 'code':79C,90C,160C 'condit':151C 'context':163C 'corrupt':77C,150C 'current':166C 'data':143C 'execut':80C,88C,159C 'exist':123C 'exploit':103C 'file':74C,119C,129C 'flaw':122C 'instal':93C 'interact':99C 'issu':131C 'lack':135C 'leverag':155C 'malici':113C,118C 'memori':76C,149C 'must':110C 'ogm':73C,128C 'open':116C 'origin':71C,96C 'originlab':70C,95C 'page':114C 'pars':75C,126C 'process':167C 'proper':137C 'remot':78C,85C 'requir':101C 'result':132C,146C 'specif':121C 'suppli':142C 'target':109C 'user':98C,141C 'user-suppli':140C 'valid':138C 'viewer':72C,97C 'visit':111C 'vulner':81C,83C,105C,157C 'within':124C 'zdi':170C 'zdi-can':169C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114566","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114566","severity":null,"published_at":"2026-11-12T03:17:09+00:00","modified_at":"2026-11-12T03:17:09+00:00","first_seen_at":"2026-11-12T03:46:12+00:00","fetched_at":"2026-11-12T03:46:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114566:3692","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-883/","severity":null,"published_at":"2026-11-12T03:51:56+00:00","modified_at":"2026-11-12T03:51:56+00:00","first_seen_at":"2026-11-12T03:51:56+00:00","fetched_at":"2026-11-12T03:51:56+00:00","note":"ZDI-26-883 (read) confirms vendor update exists, credit rgod, reported 2026-06-02, disclosed 2026-11-06; no versions given. Vendor CVE page unreadable via web-cli. ZDI-26-586 (different OGM CVE) says fixed in 10.4.0.25; not assumed to apply here. No exploitation or PoC seen. Nothing marked verified.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-883/","https://docs.originlab.com/viewer/origin-viewer-release-notes.html"]}],"documents":[{"id":131550,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-883/","title":"ZDI-26-883: OriginLab Origin Viewer OGM File Parsing Memory Corruption RCE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":131543,"url":"https://docs.originlab.com/viewer/origin-viewer-release-notes.html","title":"Origin Viewer Release Notes","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}