Why this matters now
Zero Day Initiative advisory ZDI-26-553 discloses a memory-corruption vulnerability in OriginLab Origin Viewer tracked as CVE-2026-18294, with a CVSS rating of 7.8. The advisory describes remote arbitrary code execution on affected installations of Origin Viewer, but exploitation is not fully hands-off: a user must open a malicious file or visit a malicious page. In practical terms, this is a client-side file-format attack path — the same class of risk that routinely enters through email attachments, shared project folders, vendor portals, and “just open this dataset” workflows.
The affected component is OGW file parsing in OriginLab Origin Viewer. That matters because OGW files are likely to be treated as data, not executables, by users and by some security controls. For defenders, the risk model is familiar: a parser reaches attacker-controlled bytes, memory safety fails, and the exploit attempts to redirect execution inside the Origin Viewer process. If successful, the attacker inherits the user’s context and can use the compromised host as a foothold for credential theft, persistence, lateral movement, or ransomware staging.
At the time of this writing, the provided source does not confirm public proof-of-concept code, active in-the-wild exploitation, CISA KEV inclusion, or a specific fixed release. Treat this as a high-priority exposure-management issue rather than a known mass-exploitation event: reduce the attack surface, inventory where Origin Viewer exists, hunt for post-exploitation behavior, and apply vendor updates as soon as OriginLab publishes them.
Technical analysis
Affected product: OriginLab Origin Viewer. The source item does not enumerate exact vulnerable versions or platforms beyond affected installations of Origin Viewer; do not assume that only one build is vulnerable. Inventory every installation and validate against the vendor’s fixed-version guidance when released.
Identifiers and severity: CVE-2026-18294; ZDI-26-553; CVSS 7.8. The score is consistent with a high-impact client-side code-execution flaw requiring user interaction. Do not downgrade urgency because authentication is not required in the traditional server sense — the attacker does not need credentials if they can convince a user to open weaponized content.
Attack chain, defender view:
- Delivery: a crafted
.ogwfile is delivered through email, web download, file share, collaboration platform, or a malicious page that causes the viewer to fetch/open content. - Trigger: the user opens the file or visits a page that invokes Origin Viewer/OGW handling.
- Parser failure: Origin Viewer parses attacker-controlled OGW structures and corrupts memory.
- Execution: code runs in the context of the user and the integrity level of the Origin Viewer process.
- Post-exploitation: expect hands-on-keyboard behavior — shelling out to script interpreters, enumerating the host, disabling controls, staging payloads, establishing persistence, or attempting lateral movement.
Exploitation requirements: user interaction is required. The malicious content must be opened by a vulnerable viewer or reached through a browsing workflow that hands OGW content to the vulnerable parser. The phrase “unauthenticated” should be read as “no target-system credential is required before delivery,” not “no user action.”
Exploitation status: the news item establishes a ZDI advisory and CVE assignment but does not state confirmed active exploitation, a public exploit, or KEV listing. Confirm current status against the ZDI advisory and CISA KEV during triage; absence from those lists is not proof of safety.
Detection and response
The highest-value endpoint telemetry is not “did an OGW file exist?” — engineers open OGW files legitimately. The stronger signal is post-parser behavior: Origin Viewer or Origin spawning script interpreters, shells, unsigned binaries from user-writable paths, or living-off-the-land binaries shortly after file open. Treat .ogw files arriving in Downloads, Temp, Outlook cache, or browser cache as context that raises the severity of adjacent process events.
---
title: OriginLab Viewer Spawning Script or Shell Child Process
id: 5c7f0c1f-8b7f-4b9d-9a5c-2d0f6d2f8a11
status: experimental
description: Detects OriginLab Origin Viewer or Origin spawning common post-exploitation interpreters or shells after parsing content, consistent with exploitation of CVE-2026-18294.
references:
- http://www.zerodayinitiative.com/advisories/ZDI-26-553/
- https://attack.mitre.org/techniques/T1204/002/
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.execution
- attack.t1204.002
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- 'OriginViewer'
- 'OriginLab'
- 'Origin.exe'
selection_child:
Image|contains:
- 'cmd.exe'
- 'powershell.exe'
- 'pwsh.exe'
- 'wscript.exe'
- 'cscript.exe'
- 'mshta.exe'
- 'rundll32.exe'
- 'regsvr32.exe'
- 'certutil.exe'
- 'bitsadmin.exe'
condition: selection_parent and selection_child
falsepositives:
- Rare Origin automation or lab scripts that legitimately launch external tools; tune by parent path and approved project directories.
level: high
---
title: Suspicious OGW Open From User Download or Cache Paths
id: 9f2c7c70-5d19-4f57-a9a1-0a86c3f7e221
status: experimental
description: Identifies Origin Viewer or Origin launched with an OGW file located in user download, temp, browser cache, or mail attachment paths where weaponized files commonly land.
references:
- http://www.zerodayinitiative.com/advisories/ZDI-26-553/
- https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection_image:
Image|contains:
- 'OriginViewer'
- 'OriginLab'
- 'Origin.exe'
selection_cli:
CommandLine|contains:
- '.ogw'
selection_path:
CommandLine|contains:
- 'Downloads'
- 'Temp'
- 'AppData'
- 'Outlook'
- 'INetCache'
- 'Temporary Internet Files'
condition: selection_image and selection_cli and selection_path
falsepositives:
- Legitimate research datasets received by email or downloaded from collaborators; use as triage context and pair with child-process and network telemetry.
level: medium
let lookback = 7d;
let suspicious_children = dynamic(['cmd.exe','powershell.exe','pwsh.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe','regsvr32.exe','certutil.exe','bitsadmin.exe']);
let ogw_events = DeviceFileEvents
| where Timestamp >= ago(lookback)
| where FileName endswith '.ogw'
| where FolderPath has_any ('Downloads','Temp','AppData','Outlook','INetCache','Temporary Internet Files')
| summarize FirstOgwSeen=min(Timestamp), LastOgwSeen=max(Timestamp), OgwPaths=make_set(FolderPath, 20) by DeviceId, DeviceName, InitiatingProcessAccountName;
DeviceProcessEvents
| where Timestamp >= ago(lookback)
| where InitiatingProcessFileName has_any ('OriginViewer','Origin') or ProcessVersionInfoProductName has 'OriginLab'
| where FileName in~ (suspicious_children)
| project ChildTime=Timestamp, DeviceId, DeviceName, ChildProcess=FileName, ChildCommand=ProcessCommandLine, ParentProcess=InitiatingProcessFileName, ParentCommand=InitiatingProcessCommandLine, Account=AccountName
| join kind=leftouter ogw_events on DeviceId
| extend MinutesSinceOgw = datetime_diff('minute', ChildTime, LastOgwSeen)
| where isnull(MinutesSinceOgw) or MinutesSinceOgw between (-120 and 240)
| sort by ChildTime desc;
-- Hunt for shells or LOLBins spawned by OriginLab Origin Viewer/Origin processes
SELECT child.Pid AS ChildPid,
child.Ppid AS ParentPid,
child.Name AS ChildName,
child.Exe AS ChildExe,
child.CommandLine AS ChildCommandLine,
parent.Name AS ParentName,
parent.Exe AS ParentExe,
parent.CommandLine AS ParentCommandLine,
child.Username AS Username,
child.CreateTime AS ChildCreateTime
FROM pslist() AS child
JOIN pslist() AS parent ON child.Ppid = parent.Pid
WHERE parent.Exe =~ 'OriginViewer|OriginLab|Origin'
AND child.Name =~ 'cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin'
# Audit OriginLab presence, OGW association, and recent suspicious OGW landing zones.
$out = Join-Path $env:TEMP 'originlab_cve_2026_18294_audit.csv'
$rows = @()
$uninstallRoots = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall')
foreach ($root in $uninstallRoots) {
Get-ChildItem $root -ErrorAction SilentlyContinue | ForEach-Object {
$p = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue
if ($p.DisplayName -match 'OriginLab|Origin Viewer|Origin') {
$rows += [pscustomobject]@{ Host=$env:COMPUTERNAME; Type='InstalledProduct'; Name=$p.DisplayName; Version=$p.DisplayVersion; Publisher=$p.Publisher; Path=$p.InstallLocation; Evidence=$_.PSPath }
}
}
}
Get-ChildItem -LiteralPath ${env:ProgramFiles}, ${env:ProgramFiles(x86)} -Recurse -Filter OriginViewer.exe -ErrorAction SilentlyContinue | ForEach-Object {
$v = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($_.FullName)
$rows += [pscustomobject]@{ Host=$env:COMPUTERNAME; Type='Binary'; Name=$_.Name; Version=$v.FileVersion; Publisher=$v.CompanyName; Path=$_.FullName; Evidence='Filesystem' }
}
$assoc = cmd /c 'assoc .ogw 2>$null'
$ftype = cmd /c 'ftype 2>$null' | Select-String -Pattern 'ogw|Origin'
$rows += [pscustomobject]@{ Host=$env:COMPUTERNAME; Type='Association'; Name='.ogw'; Version=''; Publisher=''; Path=($assoc -join ';'); Evidence=($ftype -join ';') }
Get-ChildItem -LiteralPath $env:TEMP, $env:USERPROFILE -Recurse -Filter *.ogw -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) -and $_.FullName -match 'Downloads|Temp|AppData|Outlook|INetCache|Temporary Internet Files' } | ForEach-Object {
$rows += [pscustomobject]@{ Host=$env:COMPUTERNAME; Type='RecentOGW'; Name=$_.Name; Version=''; Publisher=''; Path=$_.FullName; Evidence=('LastWriteTime=' + $_.LastWriteTime.ToString('s')) }
}
$rows | Export-Csv -NoTypeInformation -LiteralPath $out
Write-Output ('Audit written to ' + $out + '; escalate if Origin Viewer exists with no confirmed fixed version or if RecentOGW aligns with child-process alerts.')
Remediation and hardening
- Patch as the primary fix: apply the OriginLab update that addresses CVE-2026-18294 as soon as the vendor publishes a fixed build. The provided item does not name a fixed version; do not invent one or assume “latest” is patched without release-note confirmation. Track ZDI-26-553 and OriginLab release channels, then record the exact fixed version in your vuln-management platform once available.
- Inventory first: find Origin Viewer and full Origin installations across workstations, engineering images, VDI pools, jump hosts, and lab machines. Include per-user installs and portable copies. The script above is a starting point; reconcile results with SCCM/Intune, EDR software inventory, and software-metering data.
- Reduce exposure before patching: restrict
.ogwexecution by policy where possible, remove unneeded file associations, block OGW attachments at email and web gateways for populations that do not need them, and require detonation/sandbox analysis for OGW files that must enter the environment. - Constrain post-exploitation: enable or validate Attack Surface Reduction rules for Office/client process child-process creation where applicable, block script interpreters for standard users via AppLocker/WDAC if operationally feasible, enforce LAPS-managed local admin removal, and ensure PowerShell logging, Script Block Logging, and process command-line auditing are collected.
- Network containment: alert on unexpected egress from viewer processes following document open, and ensure DNS/web egress filtering can rapidly sinkhole newly observed payload domains. Do not rely on domain indicators from this item; none are provided.
- User workflow control: for research groups, define an approved intake path for third-party OGW files: quarantine share, sandbox detonation, opening only on patched hosts, and prohibition on double-clicking files from external email.
- If exploitation is suspected: isolate the host, preserve the OGW file and browser/email artifacts, capture memory if feasible, collect process ancestry and Amcache/Shimcache/RecentFiles, reset credentials used interactively on the host, and review adjacent systems for the same user’s access. Escalate to IR if Origin Viewer spawned shells, made unusual egress, or was followed by credential-access artifacts.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.