Out-Of-Bounds Write Vulnerability in OriginLab OriginPro Product
CVE-2026-18289

7.8HIGH

Key Information:

Vendor

Originlab

Status
Originpro
Vendor
CVE Published:
20 August 2026

What is CVE-2026-18289?

The vulnerability related to OriginLab's OriginPro arises from an improper validation in the parsing of OPJ files. This flaw enables remote attackers to execute arbitrary code by exploiting the software to write past the allocated data structure boundary. The attack vector requires user interaction, necessitating that victims visit a malicious webpage or open a specially crafted OPJ file. When exploited, this vulnerability allows attackers to run unauthorized code within the context of the current process, potentially compromising system integrity and data security.

Affected Version(s)

OriginPro 2026 SR1

References

https://www.zerodayinitiative.com/advisories/ZDI-26-548/
x_research-advisory
https://docs.originlab.com/cve/CVE-2026-18289
vendor-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.