Memory Corruption RCE in OriginLab Origin Viewer via Malicious OGM Files
A memory corruption vulnerability (CWE-119) in OriginLab Origin Viewer allows remote attackers to execute arbitrary code in the context of the current process when a victim opens a malicious OGM file or visits a malicious web page. The flaw stems from improper validation of user-supplied data during OGM file parsing, which can corrupt memory and lead to full compromise of the affected workstation. Because the attack vector is local (AV:L) and requires user interaction (UI:R), exploitation depends on socially engineering a target into opening a weaponized file, a pattern well suited to spearphishing campaigns against research and academic users. Affected users are those running OriginLab Origin Viewer, a free desktop utility used to inspect Origin project and graph files common in scientific data analysis. No public proof of concept is known and the vulnerability is not listed in CISA's KEV catalog.
What to do: Do not open OGM (or other Origin) files received from untrusted sources or follow links that auto-open such files, since exploitation requires user interaction. Check the ZDI-26-586 advisory and OriginLab's site for a patched version and upgrade the Viewer as soon as a fix ships. As defense-in-depth, run Origin Viewer under a non-administrator account and consider blocking or sandboxing OGM file types at the email gateway.
| Product | Affected |
|---|---|
| OriginLab Origin Viewer | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29340.
ZDI advisory ZDI-26-586 reports a memory corruption RCE (CVE-2026-19886, CVSS 7.8) in OriginLab Origin Viewer OGM file parsing, needing user interaction.
Today 1.6K readers · 2.5K views · 778 reads · all time 189K views