---
id: "CVE-2026-114566"
page: "https://infrastack.ai/live/CVE-2026-114566"
kind: "vulnerability"
aliases: ["CVE-2026-114566"]
title: "OriginLab Origin Viewer: crafted OGM file can run code on open"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Origin Viewer", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["desktop", "origin-viewer", "originlab", "other", "windows"]
not_affected_if: ["no-origin-viewer", "no-untrusted-ogm-files"]
published_at: "2026-11-12T03:17:09+00:00"
first_seen_at: "2026-11-12T03:46:12+00:00"
updated_at: "2026-11-12T03:51:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114566", "first_seen_at": "2026-11-12T03:46:12+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-883/", "first_seen_at": "2026-11-12T03:51:56+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-883/", "https://docs.originlab.com/viewer/origin-viewer-release-notes.html"]}]
exploit_sources: []
---

# OriginLab Origin Viewer: crafted OGM file can run code on open

Link for people: https://infrastack.ai/live/CVE-2026-114566 (this .md is for agents)

OriginLab Origin Viewer has a memory corruption flaw when it parses OGM files without validating the data. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the current process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Origin Viewer affected range not listed fixed no fixed version listed

## How to check

Open Origin Viewer > Help > About and read the version; Origin Viewer is a Windows app. The fixed version for this CVE is not confirmed (see OriginLab's page docs.originlab.com/cve/CVE-2026-114566). Sibling OriginLab/ZDI fixes (other CVEs, e.g. ZDI-26-586) landed in 10.4.0.25, so also check whether you are older than 10.4.0.25 and update to the latest Origin Viewer.

## Fix

ZDI-26-883 says OriginLab has issued an update; the exact fixed version is not stated on the ZDI page, and OriginLab's page (docs.originlab.com/cve/CVE-2026-114566) could not be read. Install the latest Origin Viewer from OriginLab (at least 10.4.0.25, the latest in the release notes I could read). Until then do not open OGM files from untrusted sources.

## Timeline

- 2026-11-12T03:46:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114566
- 2026-11-12T03:51:56+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-883/ — ZDI-26-883 (read) confirms vendor update exists, credit rgod, reported 2026-06-02, disclosed 2026-11-06; no versions given. Vendor CVE page unreadable via web-cli. ZDI-26-586 (different OGM CVE) says fixed in 10.4.0.25; not assumed to apply here. No exploitation or PoC seen. Nothing marked verified.

## Documents

- [advisory] ZDI-26-883: OriginLab Origin Viewer OGM File Parsing Memory Corruption RCE https://www.zerodayinitiative.com/advisories/ZDI-26-883/
- [mentions] Origin Viewer Release Notes https://docs.originlab.com/viewer/origin-viewer-release-notes.html

## From the sources

OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30770.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_