ZDI-26-638: Oracle Outside In Technology WPS File Parsing Memory Corruption Remote Code Execution Vulnerability
ZDI disclosed memory corruption in Oracle Outside In Technology's WPS file parsing (CVE-2026-60414) enabling user-triggered remote code execution.
Zero Day Initiative published ZDI-26-638, a CVSS 7.8 memory corruption vulnerability in WPS file parsing within Oracle Outside In Technology. Remote attackers can execute arbitrary code on affected installations by convincing the target to visit a malicious page or open a malicious file, so user interaction is required. The issue is tracked as CVE-2026-60414. The advisory reports no exploitation.
- Memory corruption in WPS file parsing, tracked as CVE-2026-60414
- CVSS 7.8 remote code execution in Oracle Outside In Technology
- User interaction required: opening a malicious file or page
- Disclosed as ZDI-26-638; no in-the-wild exploitation reported
- CVEs
- CVE-2026-60414
- Vendors
- OracleZero Day Initiative
- Products
- Oracle Outside In Technology
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-60414 | Memory Corruption in WPS File Parsing in Oracle Outside In Technology 8.5.8 | 7.8 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle Outside In Technology. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.