EUVD-2026-63443
GHSA-qq8f-f5x4-9pr4
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-based delivery requires local open action (AV:L, UI:R); no attacker privileges needed; full triad impact within the user process (S:U).
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
OriginLab Origin Viewer OGW File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of OGW files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29338.
AnalysisAI
Remote code execution is possible in OriginLab Origin Viewer through a memory corruption flaw triggered during OGW file parsing. An attacker can exploit this by enticing a target user to open a maliciously crafted OGW file or visit a page that delivers one, executing arbitrary code in the context of the current user process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target user open a malicious OGW file using OriginLab Origin Viewer 9.9.5 - either by directly opening a downloaded file or by visiting a web page that triggers the viewer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 base score of 7.8 reflects a local attack vector (AV:L), low complexity (AC:L), no required privileges (PR:N), mandatory user interaction (UI:R), and full high-impact triad (C:H/I:H/A:H) - consistent with a file-based RCE requiring a user to open a malicious document. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the OriginLab vendor advisory at https://docs.originlab.com/cve/CVE-2026-18294 for the official patched release - a specific fixed version number is not independently confirmed from the available input data, so verify the advisory directly before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running OriginLab Origin Viewer and identify user populations who handle OGW files from external sources; issue security alert instructing users to avoid opening untrusted OGW files and to report suspicious file delivery attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Origin Viewer
View allRemote code execution in OriginLab Origin Viewer 9.9.5 is achievable by tricking a user into opening a specially crafted
Memory corruption in the OGM file parser of OriginLab Origin Viewer (CWE-119) lets an attacker run arbitrary code in the
OriginLab Origin Viewer fails to properly validate user-supplied data while parsing OGWU files, resulting in an out-of-b
Same weakness CWE-119 – Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today