Description
OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29333.
Published: 2026-08-20
Score: 7.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

OriginLab OriginPro is vulnerable to an out‑of‑bounds write during OGG file parsing. The flaw arises because the application does not properly validate user‑supplied data, which enables a malicious OGG file to corrupt memory beyond a buffer and execute arbitrary code in the context of the current process.

Affected Systems

The vulnerability impacts OriginLab OriginPro on all platforms that include the OGG parser. The CNA list is OriginLab:OriginPro; specific version ranges are not disclosed in the advisory.

Risk and Exploitability

With a CVSS score of 7.8, the vulnerability is classified as high severity. Exploitation requires user interaction, such as opening a malicious file or visiting a page that triggers the parser, indicating that the attack is remote but not purely automated. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, yet the remote code execution potential warrants immediate action.

Generated by OpenCVE AI on August 20, 2026 at 20:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch or upgrade to the fixed version of OriginLab OriginPro.
  • Disable or restrict OGG file support or enforce file‑type filtering to prevent accidental opening of untrusted files.
  • Maintain up‑to‑date antivirus and endpoint protection to detect and block malicious OGG files or malicious web content.

Generated by OpenCVE AI on August 20, 2026 at 20:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
Description OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29333.
Title OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Weaknesses CWE-787
References
Metrics cvssV3_0

{'score': 7.8, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: zdi

Published:

Updated: 2026-08-20T16:21:10.216Z

Reserved: 2026-07-29T17:08:49.673Z

Link: CVE-2026-18290

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-20T17:17:25.647

Modified: 2026-08-20T17:17:25.647

Link: CVE-2026-18290

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T20:30:05Z

Weaknesses