Remote Code Execution in OriginLab Origin Viewer (CVE‑2026‑114558) via OPJU File Parsing
What It Is — OriginLab Origin Viewer contains an out‑of‑bounds write flaw in the parser for OPJU files. An attacker who convinces a user to open a crafted OPJU file (or load a malicious web page that triggers the parser) can write past the allocated buffer and execute arbitrary code in the context of the viewer process. The vulnerability is rated CVSS 7.8 (High) with network‑local attack vector, no authentication required, and user interaction required. OriginLab has released a patch; the advisory was publicly disclosed on 6 Nov 2026 (ZDI‑26‑886).
Affected Products — OriginLab Origin Viewer (all versions prior to the November 2026 security update).
Why It Matters for Trust & Control Assurance — This issue tests the control objective of vulnerability and patch management – the ability to identify, assess, and remediate software flaws promptly. Effective evidence of this control satisfies many frameworks simultaneously. Capability focus: CONTROL_MAPPING.
Recommended Actions —
- Apply OriginLab’s November 2026 patch immediately and verify the installed version.
- Update your asset inventory to flag all endpoints running Origin Viewer and track patch status.
- Integrate the patch‑deployment event into your continuous monitoring platform to retain defensible evidence for audits.
- Review your vulnerability‑management workflow to ensure user‑initiated file openings are logged and anomalous activity is alerted.
Source: Zero Day Initiative Advisory