ZDI-26-551: OriginLab OriginPro OGG File Parsing Memory Corruption Remote Code Execution Vulnerability

OriginLab OriginPro contains a memory corruption flaw (CWE-119) in its parsing of OGG files, caused by insufficient validation of user-supplied data. An attacker exploits it by convincing a user to open a malicious OGG file (or, per the advisory, visit a malicious page), which triggers the memory corruption and allows execution of arbitrary code in the context of the current process. Any installation of OriginPro whose users open OGG data files from untrusted sources is potentially affected; the available data does not specify affected version ranges. Exploitation is not currently observed: there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only ~0.2% probability of exploitation within 30 days. The vulnerability was disclosed through Trend Micro ZDI (ZDI-CAN-29335, advisory ZDI-26-551).

Do: Check advisory ZDI-26-551 and OriginLab's release notes for the fixed OriginPro version and upgrade promptly, as fixed-version details are not included in the available data. Until patched, do not open OGG files from untrusted sources in OriginPro and brief users who routinely exchange lab data files. No KEV listing or public PoC exists yet, so treat this as a watch-list item and re-check EPSS/KEV status for changes.