Out-of-Bounds Write Vulnerability in OriginLab OriginPro
CVE-2026-18288

7.8HIGH

Key Information:

Vendor

Originlab

Status
Originpro
Vendor
CVE Published:
20 August 2026

What is CVE-2026-18288?

A vulnerability exists within OriginLab's OriginPro software that can lead to remote code execution via the exploitation of OPJU file parsing. This security flaw allows attackers to write past the boundaries of a designated memory structure due to insufficient validation of user-supplied input. To exploit this vulnerability, the target user must interact with malicious content, either by navigating to a harmful webpage or opening a specially crafted file. An attacker can gain control over the execution context, potentially leading to unauthorized commands being run on the affected machine.

Affected Version(s)

OriginPro 2026 SR1

References

https://www.zerodayinitiative.com/advisories/ZDI-26-547/
x_research-advisory
https://docs.originlab.com/cve/CVE-2026-18288
vendor-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.