EUVD-2026-63442
GHSA-389c-f9cf-c585
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must reside locally (AV:L); no attacker privileges needed to craft the OPJ payload (PR:N); victim must open the file (UI:R); full process compromise achievable (C:H/I:H/A:H).
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of OPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29336.
AnalysisAI
Remote code execution in OriginLab Origin Viewer 9.9.5 is achievable by tricking a user into opening a specially crafted OPJ project file, triggering an out-of-bounds write in the file parser that corrupts memory and redirects execution to attacker-controlled code. The vulnerability was discovered and reported by Zero Day Initiative (ZDI-CAN-29336) and carries a CVSS 7.8 score with full confidentiality, integrity, and availability impact scoped to the user process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open a specially crafted OPJ file using Origin Viewer, either directly or via a web page that triggers the file association. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) signals a file-borne local attack requiring user interaction, which meaningfully constrains real-world exploitation compared to network-reachable, zero-click vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the OriginLab vendor advisory at https://docs.originlab.com/cve/CVE-2026-18293 for patch availability; a specific fixed version number is not confirmed from the available intelligence data, so the advisory is the authoritative source. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediate actions (24 hours): Identify and inventory all systems running OriginLab Origin Viewer 9.9.5, categorize by user role and data access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Origin Viewer
View allSame weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today