ZDI-26-586: OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability

A memory corruption vulnerability (CWE-119) in OriginLab Origin Viewer allows remote attackers to execute arbitrary code in the context of the current process when a victim opens a malicious OGM file or visits a malicious web page. The flaw stems from improper validation of user-supplied data during OGM file parsing, which can corrupt memory and lead to full compromise of the affected workstation. Because the attack vector is local (AV:L) and requires user interaction (UI:R), exploitation depends on socially engineering a target into opening a weaponized file, a pattern well suited to spearphishing campaigns against research and academic users. Affected users are those running OriginLab Origin Viewer, a free desktop utility used to inspect Origin project and graph files common in scientific data analysis. No public proof of concept is known and the vulnerability is not listed in CISA's KEV catalog.

Do: Do not open OGM (or other Origin) files received from untrusted sources or follow links that auto-open such files, since exploitation requires user interaction. Check the ZDI-26-586 advisory and OriginLab's site for a patched version and upgrade the Viewer as soon as a fix ships. As defense-in-depth, run Origin Viewer under a non-administrator account and consider blocking or sandboxing OGM file types at the email gateway.