Remote Code Execution in OriginLab Origin Viewer (CVE‑2026‑114560) Enables Arbitrary Code Execution via Malicious OPJ Files
OriginLab’s Origin Viewer contains an out‑of‑bounds write in its OPJ file parser (CVE‑2026‑114560) that allows remote code execution when a user opens a crafted file. The vulnerability scores 7.8 (High) and is patched by the vendor. Organizations must patch promptly to satisfy control objectives for vulnerability management and maintain audit‑ready evidence.
ADTP Breach Watch· November 6, 2026· Zero Day Initiative
SeverityHigh
Type🐛 Vulnerability
ConfidenceHigh
ReportedNov 6, 2026
Technology & SaaSTECH_SAASVulnerability Exploit
What happened
The Zero Day Initiative advisory ZDI‑26‑877 describes a flaw in the OPJ file parsing routine of OriginLab Origin Viewer. Improper validation of user‑supplied data leads to an out‑of‑bounds write, enabling an attacker who can deliver a malicious OPJ file (or a web page that triggers the file) to execute arbitrary code in the viewer’s process. The vulnerability is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). OriginLab released a security update on 2026‑11‑06 to remediate the issue.
Why it matters for trust and compliance
This vulnerability highlights the importance of a disciplined patch‑management control—ensuring software is kept current and remediation evidence is captured for audit readiness across frameworks such as NIST CSF and ISO 27001.
Demonstrates the need for continuous vulnerability monitoring to satisfy patch‑management control objectives.
Provides a concrete audit artifact (patch deployment evidence) that maps to multiple compliance frameworks.
Who is affected
TECH_SAAS
Recommended actions
Apply OriginLab’s November 2026 security update to all Origin Viewer installations.
Run an inventory scan to confirm patch status and record remediation in your control evidence repository.
Subscribe to vendor advisory feeds and integrate them into a continuous monitoring workflow.
Details
CVEs
CVE-2026-114560
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.