ZDI-CAN-29338: ZDI-26-553: OriginLab Origin Viewer OGW File Parsing Memory Corruption Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-18294.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Given user interaction is required (victim must visit a malicious page or open a malicious file), mitigate by restricting access to untrusted web content and preventing users from opening untrusted files in environments where OriginLab Origin Viewer is used.
- Compensating control
Apply the mitigation associated with ZDI-26-553 for OriginLab Origin Viewer (OGW file parsing memory corruption leading to remote code execution).
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-29338?
ZDI-CAN-29338 has a CVSS rating of 7.8, indicating its high severity.
What are the potential impacts of ZDI-CAN-29338?
ZDI-CAN-29338 allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer.
How do I fix ZDI-CAN-29338?
Users should update to the latest version of OriginLab Origin Viewer as soon as a patch is made available.
What is required for an attacker to exploit ZDI-CAN-29338?
User interaction is required to exploit ZDI-CAN-29338 by visiting a malicious page or opening a malicious file.
Which product is affected by ZDI-CAN-29338?
ZDI-CAN-29338 affects the OriginLab Origin Viewer software.