CVE-2019-12828
An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of...
An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to inject additional arguments into the Origin process and ultimately leverage code execution by loading a backdoored Qt plugin remotely via the platformpluginpath argument supplied with a Windows network share.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to inject additional arguments into the Origin process and ultimately leverage code execution by loading a backdoored Qt plugin remotely via the platformpluginpath argument supplied with a Windows network share.
- Record
CVE-2019-12828- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-19
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to inject additional arguments into the Origin process and ultimately leverage code execution by loading a backdoored Qt plugin remotely via the platformpluginpath argument supplied with a Windows network share.
- Record
CVE-2019-12828- Updated
- 2026-11-02
EUVDEUVD-2019-4408 No score
An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to inject additional arguments into the Origin process and ultimately leverage code execution by loading a backdoored Qt plugin remotely via the platformpluginpath argument supplied with a Windows network share.
- Record
EUVD-2019-4408- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vv87-5f3g-cfw2
An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of...
An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to inject additional arguments into the Origin process and ultimately leverage code execution by loading a backdoored Qt plugin remotely via the platformpluginpath argument supplied with a Windows network share.
- Record
GHSA-vv87-5f3g-cfw2- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | EA Origin < 10.5.38 - Remote Code Execution | 2019-06-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12828 is a high vulnerability (CVSS 8.8) in Ea Origin, published June 14, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.3%, the 96th percentile. No source names a fixed version.
References
zeropwn.github.io/2019-05-22-fun-with-uri-handlers
youtube.com/watch?v=E9vCx9KsF3c
bleepingcomputer.com/news/security/qt5-based-gui-apps-susceptible-to-remote-code-execution
zerodayinitiative.com/advisories/ZDI-19-574
packetstormsecurity.com/files/153385/EA-Origin-Remote-Code-Execution.html
nvd.nist.gov/vuln/detail/CVE-2019-12828
github.com/advisories/GHSA-vv87-5f3g-cfw2