ZDI-26-551: OriginLab OriginPro OGG File Parsing Memory Corruption Remote Code Execution Vulnerability
ZDI advisory ZDI-26-551 discloses CVE-2026-18292, memory corruption in OriginLab OriginPro OGG file parsing enabling remote code execution with user interaction.
OriginLab OriginPro contains a memory corruption vulnerability when parsing OGG files, tracked as CVE-2026-18292 with CVSS 7.8. Remote code execution requires user interaction, meaning the target must open a malicious file or visit a malicious page. ZDI published the finding as advisory ZDI-26-551.
- Memory corruption in OGG file parsing, CVE-2026-18292, CVSS 7.8
- RCE requires user to open malicious file or visit malicious page
- Third OriginPro parsing flaw disclosed by ZDI this batch
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-18292 | Memory Corruption RCE in OriginLab OriginPro OGG File Parsing | 7.8 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro . User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.