OriginLab OriginPro has a flaw in its OGG file parser that can lead to memory corruption. The vulnerability stems from insufficient validation of data supplied in OGG files, allowing an attacker to craft a malicious file that overwrites memory and causes the application to execute arbitrary code in the context of the user’s process. The potential impact includes loss of confidentiality, integrity, and availability of the affected system, as an attacker could gain full control of the host where OriginPro is running.

The issue affects OriginLab OriginPro installations. No specific version numbers are listed in the advisory, so all currently supported versions should be considered potentially vulnerable until a vendor‑issued update is applied.

The CVSS score of 7.8 indicates a high severity. The EPSS score is not provided, but the lack of publicly listed exploit code and the necessity for a user to open or view a malicious file suggest a moderate to low exploitation probability in uncontrolled environments. The vulnerability is not listed in the CISA KEV catalog, further implying that widespread exploitation has not yet been reported. The likely attack vector requires an attacker to distribute a malicious OGG file or a web page that prompts the user to open one. Once the file is processed, the memory corruption is triggered, leading to remote code execution.