EUVD-2026-79132
GHSA-xfgg-53v7-958w
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Triggered by opening a crafted local OGWU file, so AV:L and UI:R; no auth needed (PR:N) and low-complexity heap overwrite gives full C/I/A.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29337.
AnalysisAI
OriginLab Origin Viewer fails to properly validate user-supplied data while parsing OGWU files, resulting in an out-of-bounds write past the end of an allocated buffer. An attacker who convinces a victim to open a crafted OGWU file (or visit a page that loads one) can corrupt memory and execute arbitrary code in the context of the current process, with CVSS 3.0 base score 7.8 (AV:L/AC:L/PR:N/UI:R). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open a malicious OGWU file in OriginLab Origin Viewer, or to visit a page that causes such a file to be loaded - the CVSS 3.0 vector specifies UI:R, so user interaction is mandatory and no zero-click or wormable path exists. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a low-complexity, unauthenticated memory-corruption bug that requires the victim to open a malicious file - a pattern typical of weaponized document/attachment attacks rather than remotely reachable services. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available intelligence, so obtain the current Origin Viewer build directly from OriginLab and confirm with the vendor or with ZDI-26-585 (https://www.zerodayinitiative.com/advisories/ZDI-26-585/) whether a fix has been issued; ZDI advisories typically publish alongside or after a vendor fix, so a patched release may exist even though the version string is absent here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Origin Viewer
View allRemote code execution is possible in OriginLab Origin Viewer through a memory corruption flaw triggered during OGW file
Remote code execution in OriginLab Origin Viewer 9.9.5 is achievable by tricking a user into opening a specially crafted
Memory corruption in the OGM file parser of OriginLab Origin Viewer (CWE-119) lets an attacker run arbitrary code in the
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today