The OriginPro OGW file parsing vulnerability allows an attacker that can trick a user into opening a malicious OGW file or visiting a malicious web page to overwrite heap memory and execute arbitrary code in the context of the OriginPro process. The flaw arises from missing validation when processing OGW data, resulting in a buffer overflow. Successful exploitation would give an attacker the same privileges as the user running the application, enabling remote code execution.

OriginLab OriginPro installations are affected; the specific product version affected is not publicly disclosed in the advisory. All users running any unpatched version of OriginPro that still includes the OGW parser should assume vulnerability until a patch is applied.

The advisory lists a CVSS score of 7.8, indicating high severity, while the EPSS score is not provided and the vulnerability is not yet in the CISA KEV catalog. Because the attack requires the target to open a malicious file or access a malicious page, user interaction is required. Nevertheless, once the user engages with the malicious content, the attacker can achieve full code execution locally with the application's privileges. Given the lack of an EPSS estimate, the risk of exploitation remains uncertain but potentially significant due to the high CVSS rating.