Remote Code Execution Vulnerability in OriginLab OriginPro
CVE-2026-18291

7.8HIGH

Key Information:

Vendor

Originlab

Status
Originpro
Vendor
CVE Published:
20 August 2026

What is CVE-2026-18291?

A security flaw in OriginLab OriginPro allows remote attackers to execute arbitrary code through improper validation during OGW file parsing. The vulnerability exists due to memory corruption triggered by crafted user inputs. This requires user interaction, such as visiting a malicious webpage or opening a compromised file, thereby enabling remote exploitation within the context of the affected process. For further technical details, please refer to the vendor advisory.

Affected Version(s)

OriginPro 2026 SR1

References

https://www.zerodayinitiative.com/advisories/ZDI-26-550/
x_research-advisory
https://docs.originlab.com/cve/CVE-2026-18291
vendor-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.