CVE-2019-12828

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-06-14 · updated 2026-06-17
Weakness: CWE-19

Description

An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to inject additional arguments into the Origin process and ultimately leverage code execution by loading a backdoored Qt plugin remotely via the platformpluginpath argument supplied with a Windows network share.

Affected products

Origin: before 10.5.39 — fixed in 10.5.39

How to fix

Upgrade to a fixed version: Origin 10.5.39. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/153385/EA-Origin-Remote-Code-Execution.html
https://www.bleepingcomputer.com/news/security/qt5-based-gui-apps-susceptible-to-remote-code-execution/
https://www.youtube.com/watch?v=E9vCx9KsF3c
https://www.zerodayinitiative.com/advisories/ZDI-19-574/
https://zeropwn.github.io/2019-05-22-fun-with-uri-handlers/
http://packetstormsecurity.com/files/153385/EA-Origin-Remote-Code-Execution.html
https://www.bleepingcomputer.com/news/security/qt5-based-gui-apps-susceptible-to-remote-code-execution/
https://www.youtube.com/watch?v=E9vCx9KsF3c
https://www.zerodayinitiative.com/advisories/ZDI-19-574/
https://zeropwn.github.io/2019-05-22-fun-with-uri-handlers/

Get alerted when CVE-2019-12828 or the next vulnerability affects your stack