Origin Viewer
Monthly
Remote code execution is possible in OriginLab Origin Viewer through a memory corruption flaw triggered during OGW file parsing. An attacker can exploit this by enticing a target user to open a maliciously crafted OGW file or visit a page that delivers one, executing arbitrary code in the context of the current user process. No public exploit or CISA KEV listing has been identified at time of analysis, but the vulnerability was discovered and reported by Zero Day Initiative (ZDI-CAN-29338), indicating structured third-party research.
Remote code execution in OriginLab Origin Viewer 9.9.5 is achievable by tricking a user into opening a specially crafted OPJ project file, triggering an out-of-bounds write in the file parser that corrupts memory and redirects execution to attacker-controlled code. The vulnerability was discovered and reported by Zero Day Initiative (ZDI-CAN-29336) and carries a CVSS 7.8 score with full confidentiality, integrity, and availability impact scoped to the user process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Remote code execution is possible in OriginLab Origin Viewer through a memory corruption flaw triggered during OGW file parsing. An attacker can exploit this by enticing a target user to open a maliciously crafted OGW file or visit a page that delivers one, executing arbitrary code in the context of the current user process. No public exploit or CISA KEV listing has been identified at time of analysis, but the vulnerability was discovered and reported by Zero Day Initiative (ZDI-CAN-29338), indicating structured third-party research.
Remote code execution in OriginLab Origin Viewer 9.9.5 is achievable by tricking a user into opening a specially crafted OPJ project file, triggering an out-of-bounds write in the file parser that corrupts memory and redirects execution to attacker-controlled code. The vulnerability was discovered and reported by Zero Day Initiative (ZDI-CAN-29336) and carries a CVSS 7.8 score with full confidentiality, integrity, and availability impact scoped to the user process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.