ZDI-26-635: Oracle Outside In Technology PDF File Parsing Integer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle Outside In Technology. User interaction is required to exploit this vulnerability in that the target must open a malicious file or visit a malicious page. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-60392.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must persuade the target to open a malicious PDF file or visit a malicious page. Successful exploitation can result in arbitrary code execution on an affected installation.
Who is exposed to this vulnerability?
Users of affected Oracle Outside In Technology installations are exposed when they open attacker-controlled PDF content or visit an attacker-controlled page. The provided information does not identify affected versions or whether any default configuration is affected.
How can I determine whether an installation is affected?
Confirm whether the installation uses Oracle Outside In Technology and consult the vendor advisory for CVE-2026-60392. The provided data does not include affected version or patch information.