ZDI-26-638: Oracle Outside In Technology WPS File Parsing Memory Corruption Remote Code Execution Vulnerability

Oracle Outside In Technology (Outside In Core) version 8.5.8 contains a memory corruption flaw triggered while parsing WPS-format documents, per the Zero Day Initiative advisory. An unauthenticated attacker who has logon access to the infrastructure where the Outside In engine runs must get a person other than themselves to interact with the crafted file, at which point the parsing process is compromised. Successful exploitation results in takeover of Oracle Outside In Technology, with high confidentiality, integrity, and availability impact (CVSS 3.1 score 7.8, local attack vector with user interaction). Because Outside In is a document-conversion/preview engine embedded inside Oracle Fusion Middleware and other products, anyone running an affected deployment that processes untrusted WPS documents is exposed. There is currently no public proof of concept, no listing in CISA's KEV, and a low 0.2% EPSS probability of exploitation within 30 days, indicating no known exploitation activity.

Do: Upgrade Outside In Technology 8.5.8 to the patched release distributed through the Oracle Critical Patch Update that addresses CVE-2026-60414, and identify which Oracle Fusion Middleware (or third-party) products bundle Outside In so they are patched together. Until patched, restrict or inspect untrusted WPS files before they reach the Outside In conversion engine and limit local logon access to the systems where it runs. Monitor Oracle's advisory for the fixed version applicable to your product bundles, since Outside In is typically consumed as an embedded component rather than patched directly.