The vulnerability is an out‑of‑bounds write in the parsing logic for OPJ files. When the parser processes a crafted OPJ file it writes beyond the allocated buffer, allowing a remote attacker to overwrite internal data structures and execute arbitrary code in the context of the OriginPro process. The flaw originates from a missing boundary check on user‑supplied data, classifying it as a classic out‑of‑bounds write (CWE‑787). The impact is that any user who opens a malicious OPJ file, or visits a page that triggers automatic file loading, can have arbitrary code run on that system without additional privileges.

This flaw affects OriginLab OriginPro installations. Specific version information is not listed in the advisory, so all installations of OriginPro that have not applied the vendor‑provided fix are potentially vulnerable.

The CVSS score is 7.8, indicating a high severity level. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog, implying no confirmed exploitation in the wild as of the advisory. The attack requires user interaction; a malicious file or page that forces OriginPro to parse a crafted OPJ file is sufficient. Once the out‑of‑bounds write is triggered, the attacker can gain execution privileges at the same level as the current user.