This vulnerability stems from an out‑of‑bounds write that occurs while Origin Viewer parses OPJ files. The flaw is caused by insufficient validation of user‑supplied input, allowing data to be written past the end of a memory buffer. An attacker can exploit this to execute arbitrary code in the context of the current process, resulting in full compromise of the affected system. As the exploitation requires the target to open a malicious OPJ file or visit a malicious page, the attack vector is user interaction, typically involving social engineering or a phishing campaign.

The affected product is OriginLab Origin Viewer. Version information was not disclosed in the advisory, so all releases of Origin Viewer are potentially impacted until an official advisory or patch is published.

The vulnerability has a CVSS score of 7.8, indicating high severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. Attackers are able to execute code remotely, but only after the victim opens a crafted OPJ file or visits a malicious page, implying the need for user interaction. The risk remains significant for organizations that rely on Origin Viewer and have users who may open opaque files.