Heap Buffer Overflow in OriginLab Origin Viewer (CVE‑2026‑114568) Enables Remote Code Execution
What It Is — The Zero Day Initiative advisory (ZDI‑26‑885) details a heap‑based buffer overflow in the OPJ file parser of OriginLab Origin Viewer. An attacker who convinces a user to open a crafted OPJ file (or load a malicious web page that triggers the parser) can overwrite adjacent heap memory and execute arbitrary code in the context of the viewer process. The flaw scores 7.8 (CVSS v3.1) with a local attack vector, low complexity, required user interaction, and high impact on confidentiality, integrity, and availability. OriginLab has released a patch; the advisory was publicly disclosed on 6 Nov 2026.
Affected Products — OriginLab Origin Viewer (all versions prior to the November 2026 patch).
Why It Matters for Trust & Control Assurance — This incident tests the control objective of secure software development and vulnerability management; continuous evidence of patch deployment and input‑validation controls is essential.
Recommended Actions — Apply OriginLab’s update immediately, verify the installed version, update your asset inventory, and record remediation evidence for audit readiness. Source: ZDI advisory