---
id: "CVE-2026-114569"
page: "https://infrastack.ai/live/CVE-2026-114569"
kind: "vulnerability"
aliases: ["CVE-2026-114569"]
title: "OriginLab Origin Viewer: crafted OGWU file runs code on opening"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Origin Viewer", "fixed": [], "affected": "unknown (reported against 9.9.5.63 in sibling advisories)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["desktop", "origin-viewer", "other", "windows"]
not_affected_if: ["no-origin-viewer", "no-origin-viewer-installed"]
published_at: "2026-11-12T03:17:09+00:00"
first_seen_at: "2026-11-12T03:46:12+00:00"
updated_at: "2026-11-12T03:51:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114569", "first_seen_at": "2026-11-12T03:46:12+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-875/", "first_seen_at": "2026-11-12T03:51:08+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-875/", "https://docs.originlab.com/viewer/origin-viewer-release-notes.html"]}]
exploit_sources: []
---

# OriginLab Origin Viewer: crafted OGWU file runs code on opening

Link for people: https://infrastack.ai/live/CVE-2026-114569 (this .md is for agents)

OriginLab Origin Viewer has a heap buffer overflow when it parses OGWU files, because it copies user-supplied data without checking its length. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the viewer process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Origin Viewer affected unknown (reported against 9.9.5.63 in sibling advisories) fixed no fixed version listed

## How to check

Open Origin Viewer (Windows) and check its version (Help > About). Versions 9.9.5.63 and earlier are the ones OriginLab names in sibling Origin Viewer advisories; the range for this CVE is not published in the pages I could read. Also look for Origin Viewer installs on shared analysis machines, and treat .ogwu files from untrusted sources as unsafe until updated.

## Fix

OriginLab says it has issued an update (per ZDI-26-875). The exact fixed version is not confirmed for this CVE. Install the latest Origin Viewer from originlab.com/viewer; 10.4.0.25 is the current release in the release notes, and sibling advisories name 10.4.0 or later as the fix.

## Timeline

- 2026-11-12T03:46:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114569
- 2026-11-12T03:51:08+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-875/ — ZDI-26-875 (2026-11-06) says OriginLab issued an update, linking docs.originlab.com/cve/CVE-2026-114569, which I could not retrieve. Release notes for 10.4.0.25 do not list this CVE. Sibling OGWU/OPJ advisories name 10.4.0 or 10.4.0.25 as the fix, but that is not confirmed for this CVE. Nothing verified.

## Documents

- [advisory] ZDI-26-875 OriginLab Origin Viewer OGWU heap overflow https://www.zerodayinitiative.com/advisories/ZDI-26-875/
- [mentions] Origin Viewer Release Notes https://docs.originlab.com/viewer/origin-viewer-release-notes.html

## From the sources

OriginLab Origin Viewer OGWU File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30430.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_