CVE-2019-12828

Name of the Vulnerable Software and Affected Versions Electronic Arts Origin versions prior to 10.5.39

Description An issue was discovered due to improper sanitization of the origin:// and origin2:// URI schemes, allowing injection of additional arguments into the Origin process. This can lead to code execution by loading a backdoored Qt plugin remotely via the platformpluginpath argument supplied with a Windows network share.

Recommendations For versions prior to 10.5.39, update to version 10.5.39 or later to resolve the issue. As a temporary workaround, consider restricting access to the origin:// and origin2:// URI schemes to minimize the risk of exploitation. Avoid using the platformpluginpath argument in the affected URI schemes until the issue is resolved.