What is the CVSS score of CVE-2026-19886?

CVE-2026-19886 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Origin Viewer CVE-2026-19886

EUVD-2026-79133 HIGH

Buffer Overflow (CWE-119)

2026-09-15 zdi

GHSA-phqm-986v-q495

RCE Buffer Overflow Origin Viewer Originlab

7.8

CVSS 3.0 · Vendor: zdi

Severity by source

Vendor (zdi) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (zdi) · only source for this CVE.

CVSS VectorVendor: zdi

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 18:50 vuln.today

CVE Published

Sep 15, 2026 - 18:02 cve.org

HIGH 7.8

DescriptionCVE.org

OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29340.

AnalysisAI

Memory corruption in the OGM file parser of OriginLab Origin Viewer (CWE-119) lets an attacker run arbitrary code in the context of the current process when a victim opens a crafted OGM file or is lured to a page that triggers the viewer. Exploitation requires user interaction and executes with the privileges of the logged-on user rather than escalating to SYSTEM, but all three impact metrics (confidentiality, integrity, availability) are rated high, giving a CVSS 3.0 base score of 7.8. …