ZDI-26-553: OriginLab Origin Viewer OGW File Parsing Memory Corruption Remote Code Execution Vulnerability

OriginLab Origin Viewer contains a memory-corruption flaw (CWE-119) in its parsing of OGW project files, caused by insufficient validation of user-supplied data. An attacker triggers it by convincing a user to open a malicious OGW file or visit a malicious page, since user interaction is required. Successful exploitation lets the attacker execute arbitrary code in the context of the current process, with the privileges of the user running the viewer. Any installation of OriginLab Origin Viewer is affected; the disclosure does not specify particular version ranges. No public proof-of-concept or in-the-wild exploitation is known, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at a low 0.2%.

Do: Monitor OriginLab and the ZDI-26-553 advisory for a patched Origin Viewer release and update as soon as a fixed build is available; the disclosure data does not name a fixed version. Until patched, only open OGW files from trusted sources and treat unsolicited OGW attachments (e.g., via email) as suspect. Given no known exploitation, no public PoC, and low EPSS, defenders can prioritize this below actively exploited or internet-facing issues.