{"id":"CVE-2026-114569","kind":"vulnerability","aliases":["CVE-2026-114569"],"related":[],"title":"OriginLab Origin Viewer: crafted OGWU file runs code on opening","description":"OriginLab Origin Viewer OGWU File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30430.","summary":"OriginLab Origin Viewer has a heap buffer overflow when it parses OGWU files, because it copies user-supplied data without checking its length. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the viewer process.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Origin Viewer","fixed":[],"affected":"unknown (reported against 9.9.5.63 in sibling advisories)","ecosystem":"vendor"}],"ecosystems":[],"tags":["desktop","origin-viewer","other","windows"],"not_affected_if":["no-origin-viewer","no-origin-viewer-installed"],"how_to_check":"Open Origin Viewer (Windows) and check its version (Help > About). Versions 9.9.5.63 and earlier are the ones OriginLab names in sibling Origin Viewer advisories; the range for this CVE is not published in the pages I could read. Also look for Origin Viewer installs on shared analysis machines, and treat .ogwu files from untrusted sources as unsafe until updated.","fix":"OriginLab says it has issued an update (per ZDI-26-875). The exact fixed version is not confirmed for this CVE. Install the latest Origin Viewer from originlab.com/viewer; 10.4.0.25 is the current release in the release notes, and sibling advisories name 10.4.0 or later as the fix.","status":"open","published_at":"2026-11-12T03:17:09+00:00","first_seen_at":"2026-11-12T03:46:12+00:00","triaged_at":"2026-11-12T03:47:33+00:00","updated_at":"2026-11-12T03:51:08+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T03:47:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"OriginLab Origin Viewer: crafted OGWU file runs code on opening","impact":"high","summary":"OriginLab Origin Viewer has a heap buffer overflow when it parses OGWU files, because it copies user-supplied data without checking its length. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the viewer process.","audience":"businesses","category":"other","nicknames":[],"who_cares":["origin-viewer","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code in the viewer process after a user opens a file","analyst_note":"Find affected version range and vendor fix at https://nvd.nist.gov/vuln/detail/CVE-2026-114569 and the ZDI advisory for ZDI-CAN-30430.","how_to_check":"- Check whether Origin Viewer is installed on the machine and which version it is; the sources do not name the affected version range.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-origin-viewer-installed"],"who_is_affected":"Anyone running OriginLab Origin Viewer on a machine where users open OGWU files or visit web pages they do not trust. The sources do not give affected version ranges or configuration details.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4689,"output_tokens":507,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected version range and vendor fix at https://nvd.nist.gov/vuln/detail/CVE-2026-114569 and the ZDI advisory for ZDI-CAN-30430.","search":"'-114569':13A,16A '-2026':12A,15A '30430':185C 'affect':100C 'allow':92C 'arbitrari':97C 'attack':50B,94C,166C 'base':83C,163C 'buffer':31B,84C,164C 'check':46B 'code':8A,67B,87C,98C,173C 'context':70B,176C 'copi':40B,157C 'craft':4A 'current':179C 'cve':11A,14A 'data':44B,154C 'desktop':19B 'execut':88C,96C,172C 'exist':131C 'exploit':111C 'file':6A,37B,59B,79C,127C,137C 'flaw':130C 'get':52B 'heap':30B,82C,162C 'heap-bas':81C,161C 'instal':101C 'interact':107C 'issu':139C 'lack':143C 'length':48B,149C 'leverag':168C 'malici':58B,63B,121C,126C 'must':118C 'ogwu':5A,36B,78C,136C 'open':10A,56B,124C 'origin':2A,17A,21B,26B,76C,104C 'origin-view':20B 'originlab':1A,25B,75C,103C 'overflow':32B,85C 'page':64B,122C 'pars':35B,80C,134C 'prior':155C 'process':74B,180C 'proper':145C 'remot':86C,93C 'requir':109C 'result':140C 'run':7A,66B 'specif':129C 'suppli':43B,153C 'target':117C 'user':42B,54B,106C,152C 'user-suppli':41B,151C 'valid':146C 'viewer':3A,18A,22B,27B,73B,77C,105C 'visit':61B,119C 'vulner':89C,91C,113C,170C 'window':24B 'within':132C 'without':45B 'zdi':183C 'zdi-can':182C","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens Origin project files (.ogwu) in Origin Viewer on Windows. An attacker needs the user to open a crafted file or visit a page that delivers one; code then runs with that user's privileges. Teams that never install Origin Viewer or open files from untrusted sources can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["originviewer","viewer"],"ptokens":["origin","viewer"],"labels":["desktop","high","originviewer","other","windows"],"campaign_type":null,"search_a":"'-114569':13A,16A '-2026':12A,15A 'code':8A 'craft':4A 'cve':11A,14A 'file':6A 'ogwu':5A 'open':10A 'origin':2A,17A 'originlab':1A 'run':7A 'viewer':3A,18A","search_b":"'attack':50B 'buffer':31B 'check':46B 'code':67B 'context':70B 'copi':40B 'data':44B 'desktop':19B 'file':37B,59B 'get':52B 'heap':30B 'length':48B 'malici':58B,63B 'ogwu':36B 'open':56B 'origin':21B,26B 'origin-view':20B 'originlab':25B 'overflow':32B 'page':64B 'pars':35B 'process':74B 'run':66B 'suppli':43B 'user':42B,54B 'user-suppli':41B 'viewer':22B,27B,73B 'visit':61B 'window':24B 'without':45B","search_c":"'30430':185C 'affect':100C 'allow':92C 'arbitrari':97C 'attack':94C,166C 'base':83C,163C 'buffer':84C,164C 'code':87C,98C,173C 'context':176C 'copi':157C 'current':179C 'data':154C 'execut':88C,96C,172C 'exist':131C 'exploit':111C 'file':79C,127C,137C 'flaw':130C 'heap':82C,162C 'heap-bas':81C,161C 'instal':101C 'interact':107C 'issu':139C 'lack':143C 'length':149C 'leverag':168C 'malici':121C,126C 'must':118C 'ogwu':78C,136C 'open':124C 'origin':76C,104C 'originlab':75C,103C 'overflow':85C 'page':122C 'pars':80C,134C 'prior':155C 'process':180C 'proper':145C 'remot':86C,93C 'requir':109C 'result':140C 'specif':129C 'suppli':153C 'target':117C 'user':106C,152C 'user-suppli':151C 'valid':146C 'viewer':77C,105C 'visit':119C 'vulner':89C,91C,113C,170C 'within':132C 'zdi':183C 'zdi-can':182C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114569","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114569","severity":null,"published_at":"2026-11-12T03:17:09+00:00","modified_at":"2026-11-12T03:17:09+00:00","first_seen_at":"2026-11-12T03:46:12+00:00","fetched_at":"2026-11-12T03:46:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114569:3689","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-875/","severity":null,"published_at":"2026-11-12T03:51:08+00:00","modified_at":"2026-11-12T03:51:08+00:00","first_seen_at":"2026-11-12T03:51:08+00:00","fetched_at":"2026-11-12T03:51:08+00:00","note":"ZDI-26-875 (2026-11-06) says OriginLab issued an update, linking docs.originlab.com/cve/CVE-2026-114569, which I could not retrieve. Release notes for 10.4.0.25 do not list this CVE. Sibling OGWU/OPJ advisories name 10.4.0 or 10.4.0.25 as the fix, but that is not confirmed for this CVE. Nothing verified.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-875/","https://docs.originlab.com/viewer/origin-viewer-release-notes.html"]}],"documents":[{"id":131547,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-875/","title":"ZDI-26-875 OriginLab Origin Viewer OGWU heap overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":131543,"url":"https://docs.originlab.com/viewer/origin-viewer-release-notes.html","title":"Origin Viewer Release Notes","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}