ZDI-26-637: Oracle Outside In Technology GEM File Parsing Integer Overflow Remote Code Execution Vulnerability
ZDI disclosed an integer overflow in Oracle Outside In Technology's GEM file parsing (CVE-2026-60413) enabling user-triggered remote code execution.
Zero Day Initiative published ZDI-26-637, a CVSS 7.8 integer overflow in GEM file parsing within Oracle Outside In Technology. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page, and results in arbitrary code execution on affected installations. The flaw is tracked as CVE-2026-60413. No exploitation activity is reported.
- Integer overflow in GEM file parsing, tracked as CVE-2026-60413
- CVSS 7.8 remote code execution in Oracle Outside In Technology
- Requires user interaction with a malicious file or page
- Disclosed as ZDI-26-637; no exploitation reported
- CVEs
- CVE-2026-60413
- Vendors
- OracleZero Day Initiative
- Products
- Oracle Outside In Technology
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-60413 | Oracle Outside In Technology GEM File Parsing Integer Overflow Allows Takeover | 7.8 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle Outside In Technology. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.