Oracle Outside In Has Three Fresh RCEs. Legacy File Parsers Are the Door
- The Mess: Oracle Outside In Technology has three separate memory-corruption bugs in its PostScript, GEM and WPS parsers. All three can become remote code execution.
- The Damage: A malicious document can turn an application embedding Outside In into a code-execution target when a victim opens it or reaches a malicious page.
- The Fix: Patch Oracle Outside In Technology 8.5.8 immediately and identify every application that embeds the library.
Oracle Outside In Technology is not a flashy product.
It is worse.
It is a parser library buried inside enterprise software that needs to read, convert, preview or extract content from hundreds of file formats.
On September 9, ZDI published three separate RCE advisories against the same Outside In Core component. All three carry CVSS 7.8.
The vulnerable version is 8.5.8. Oracle’s August 2026 security advisory lists all three CVEs against Outside In Core.
Three Parsers. Three Ways In.
The first bug is CVE-2026-60412.
It lives in the PostScript parser and is a heap-based buffer overflow. An attacker can supply malformed PostScript data that causes memory corruption and ultimately arbitrary code execution.
The second is CVE-2026-60413.
This one targets the GEM parser. An integer overflow occurs before buffer allocation, giving an attacker control over memory handling and another route to code execution.
Then comes CVE-2026-60414.
The target is the WPS parser, where insufficient validation of attacker-controlled data leads to memory corruption and arbitrary code execution.
Different file formats.
Same basic problem.
Untrusted document data reaches complicated native parsing code.
The User Is the Trigger
There is an important limitation.
These are not unauthenticated Internet RCEs where an attacker simply connects to an exposed port and gets a shell.
The CVSS vector for all three is:
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
User interaction is required. The victim must open a malicious file or otherwise visit a malicious page that causes the vulnerable parser to process attacker-controlled content.
That still gives attackers a very practical delivery mechanism.
Email attachments.
Documents downloaded from the web.
Files uploaded to document-processing systems.
Preview and conversion workflows.
The user may never realize that Oracle Outside In is processing the file in the background.
The Real Problem Is the Embedded Library
This is where the story gets more interesting.
Outside In Technology is a component rather than a typical end-user application. It can be embedded into larger products that handle documents and attachments.
That means patching the obvious Oracle installation may not be enough.
Administrators need to determine which products actually ship or load Outside In Technology.
Oracle’s own advisory identifies the affected Outside In version as 8.5.8, while the vulnerability records show the component can appear inside broader Oracle middleware deployments.
The library can therefore sit several layers away from the software users think they are actually running.
That is exactly how parser vulnerabilities survive.
Coordinated Disclosure, Same Day
All three vulnerabilities were reported to Oracle on April 8, 2026.
ZDI publicly released the advisories on September 9 after coordinated disclosure.
The clustering is significant.
This is not one random crash found in a forgotten parser.
Three separate file-format parsers inside the same component produced exploitable memory-corruption vulnerabilities.
That should make administrators suspicious of the entire parsing surface, not just one CVE.
Patch the Library — Then Find Who Uses It
Oracle has issued updates for the affected Outside In component.
Security teams should:
- identify systems running Outside In Technology 8.5.8;
- determine which applications embed the library;
- apply Oracle’s available updates;
- restrict processing of untrusted legacy document formats where possible;
- monitor document-processing services for crashes and unexpected child processes;
- treat suspicious files processed by vulnerable systems as potential exploit attempts.
Do not rely on endpoint antivirus alone.
A memory-corruption exploit happens inside a legitimate parser before traditional malware detection necessarily has anything obvious to flag.
Bugstoday Opinion
This is why ancient file formats keep showing up in security reports.
Nobody wakes up excited about a GEM parser.
Nobody puts “PostScript attack surface” on a product roadmap.
But enterprise software keeps supporting old formats because somebody, somewhere, still has a warehouse full of documents created twenty years ago.
Attackers love that arrangement.
Three RCEs in three parsers is not a coincidence worth ignoring.
It’s a warning that legacy document support is executable attack surface.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
TrendAI Zero Day Initiative — ZDI-26-636
TrendAI Zero Day Initiative — ZDI-26-637
TrendAI Zero Day Initiative — ZDI-26-638
Oracle Critical Patch Update Advisory — August 2026
CVE-2026-60412
CVE-2026-60413
CVE-2026-60414
