ZDI-26-549: OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

OriginLab OriginPro is vulnerable to an out-of-bounds write (CWE-787) while parsing OGG files: user-supplied data is not properly validated, allowing a write past the end of an allocated data structure. Exploitation requires user interaction, meaning the target must visit a malicious page or open a malicious file containing a crafted OGG file. A successful attack allows a remote attacker to execute arbitrary code in the context of the current process, i.e., with the privileges of the user running OriginPro. Any user of OriginLab OriginPro who opens untrusted OGG files is affected; the flaw was reported via Trend Micro Zero Day Initiative (ZDI-CAN-29333, advisory ZDI-26-549). No public proof-of-concept, in-the-wild exploitation, or KEV listing is known, and EPSS estimates only a 0.2% chance of exploitation within 30 days.

Do: Check OriginLab's advisory associated with ZDI-26-549 and apply the vendor's fixed OriginPro service release as soon as it is identified, since the disclosure does not state affected or fixed version numbers. Until patched, avoid opening OGG files from untrusted sources and scrutinize email attachments and downloads that may contain them. Because the CVSS vector (AV:L/UI:R) requires local user action, user awareness is an effective interim mitigation.