Advisories
OriginLab OriginPro OGG Parsing Vulnerability Enables Remote Code Execution (CVE‑2026‑18290)
A flaw in OriginLab OriginPro’s OGG file parser allows remote attackers to execute arbitrary code when a user opens a crafted file or visits a malicious page. The issue, rated CVSS 7.8, requires user interaction and has been patched by the vendor. Defenders should verify that OriginPro is updated to the latest release and consider blocking OGG file handling until the fix is applied.
What Happened
OriginLab OriginPro incorrectly validates data in OGG audio files. The lack of bounds checking allows a crafted file to write beyond an allocated buffer, giving an attacker the ability to execute code in the context of the running OriginPro process.
Impact
Remote code execution is possible when a user opens a malicious OGG file or visits a page that triggers the parser. The vulnerability has a CVSS score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and can compromise confidentiality, integrity, and availability of the affected system.
Mitigation
- Apply the vendor‑issued patch or upgrade to the latest OriginPro release (see OriginLab documentation).
- Disable automatic opening of OGG files or restrict file types in user environments.
- Monitor for unusual process activity or unexpected network connections originating from OriginPro.
- Implement application whitelisting to prevent execution of untrusted binaries.
Vendor Response
OriginLab has released an update that fixes the out‑of‑bounds write in the OGG parser. The advisory was published on August 11 2026 and the CVE was assigned as CVE‑2026‑18290.
Related vulnerabilities
Microsoft Office Word RCE CVE-2026-108443 Omitted from October 2026 Update
A remote code execution vulnerability (CVE-2026-108443) in Microsoft Office Word was fixed in the October 2026 security update, but the CVE was omitted from the advisory list. The flaw could be triggered by a crafted document, allowing arbitrary code execution on affected systems. Defenders should verify that the October 2026 update is installed; no further action is required if it is.
Read briefing
Oracle Outside In Technology PDF Parsing Integer Overflow Enables Remote Code Execution (CVE-2026-60392)
Oracle Outside In Technology is vulnerable to an integer overflow in PDF parsing that allows remote attackers to execute code when a user opens a crafted PDF or visits a malicious page. The flaw, CVE-2026-60392, carries a CVSS score of 7.8. Oracle has released a patch; administrators should update immediately and verify the fix.
Read briefing
Microsoft Office for Mac RCE Vulnerability CVE-2026-88196 – Update Required
Microsoft released a patch for a remote code execution flaw (CVE-2026-88196) affecting Office for Mac. Admins should install the update immediately; other Office products are unaffected.
Read briefing
Microsoft Office Excel Remote Code Execution Vulnerability (CVE-2026-108446) Omitted from Oct 2026 Update
Microsoft Office Excel CVE-2026-108446, a remote code execution flaw, was fixed in the October 2026 security patch but omitted from the public update list. Systems with the October 2026 updates are already protected; no further action is required.
Read briefing