Remote Code Execution in OriginLab Origin Viewer (CVE‑2026‑114567) Out‑of‑Bounds Write Vulnerability
What It Is — OriginLab’s Origin Viewer contains an out‑of‑bounds write flaw in the parsing of OGWU files (CVE‑2026‑114567). An attacker who convinces a user to open a crafted OGWU file or visit a malicious page can trigger an out‑of‑bounds write, leading to remote code execution in the context of the viewer process. The vulnerability scores 7.8 (CVSS 3.1) with a vector of AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. No public exploits have been observed, but the flaw is actively exploitable once a user interacts with malicious content. OriginLab has released a patch; the advisory was coordinated on 2026‑11‑06.
Affected Products — OriginLab Origin Viewer (all versions prior to the November 2026 patch).
Why It Matters for Trust & Control Assurance — It tests the control objective of effective vulnerability management and timely patching; a robust patch‑management process provides the audit evidence needed across many frameworks. Capability focus: CONTROL_MAPPING.
Recommended Actions —
- Deploy OriginLab’s November 2026 update immediately.
- Verify the installed version against the vendor advisory.
- Update your asset inventory to reflect the patched software.
- Incorporate this CVE into your vulnerability‑management workflow and retain remediation evidence for audit purposes.
Source: Zero Day Initiative advisory