Oracle Outside In Technology Vulnerable to Remote Code Execution via PDF Parsing Flaw

Oracle's Outside In Technology, a suite of software development kits used for content conversion and document processing, has been found to contain a critical vulnerability that could allow attackers to execute arbitrary code on affected systems. The flaw, identified as an integer overflow within the PDF file parsing component, was disclosed by the Zero Day Initiative (ZDI) and assigned a CVSS score of 7.8.

Exploitation of this vulnerability requires user interaction, meaning an attacker must trick a user into opening a specially crafted malicious PDF file or visiting a malicious webpage that triggers the vulnerability. Once a user interacts with the malicious content, the integer overflow can occur before a buffer is properly allocated. This condition can then be leveraged by an attacker to execute code within the context of the current process, potentially leading to a full system compromise.

The specific technical detail involves the lack of proper validation of user-supplied data during the PDF parsing process. When processing malformed input, the software fails to correctly handle integer values, leading to an overflow. This overflow can corrupt memory structures, including buffer allocations, which attackers can then manipulate to inject and execute their own malicious code.

Oracle has acknowledged the vulnerability and has released an update to address it. The company detailed the fix in its security alert for August 2026, urging customers to apply the necessary patches to protect their environments. The advisory, available at Oracle's security alerts page, provides further details on the affected products and the recommended remediation steps.

The Zero Day Initiative reported the vulnerability to Oracle on March 31, 2026. Following a coordinated disclosure process, the advisory was publicly released on September 9, 2026, with an update to the advisory also published on the same day. The vulnerability was discovered by Dvir Gozlan.

This vulnerability underscores the ongoing risks associated with complex file parsing libraries. Software that handles a wide variety of file formats, especially those with intricate structures like PDFs, often presents a rich attack surface. Developers must implement robust input validation and memory management practices to prevent such flaws.

While user interaction is required, the widespread use of Oracle Outside In Technology in various enterprise applications means that a significant number of systems could be at risk if not promptly patched. The high CVSS score indicates a severe impact, making this a priority for organizations utilizing the affected Oracle products.

This disclosure serves as a reminder for organizations to maintain vigilant vulnerability management programs, including timely patching and security awareness training for users to mitigate risks associated with social engineering tactics used to deliver malicious files or links.

This advisory from Zero Day Initiative details a specific integer overflow vulnerability within Oracle Outside In Technology's GEM file parsing component, distinct from the PDF parsing flaw previously reported. The newly disclosed vulnerability, CVE-2026-60413, also allows for remote code execution but is identified as a separate issue with a CVSS score of 7.8, requiring user interaction for exploitation.

This new advisory from Zero Day Initiative details a separate remote code execution vulnerability within Oracle Outside In Technology, distinct from the previously reported PDF parsing flaw. The newly disclosed issue, ZDI-26-638, specifically targets the WPS file parsing component and is assigned CVE-2026-60414, carrying a CVSS score of 7.8. Exploitation requires user interaction, such as opening a crafted file or visiting a malicious webpage.